Detections
Analytics

4.3.4.22 Ensure rsync daemon is not in use

Information

The rsync daemon can be used to synchronize files between systems over network links.

The rsync daemon presents a security risk as the rsync protocol is unencrypted.

The rsync.rte fileset should be removed to reduce the attack area of the system.

Solution

Run the following command to remove the software:

# /usr/sbin/installp -u rsync.rte

- OR -

- IF - the rsync.rte fileset is required as a dependency, or the rsync client is required:

In /etc/inetd.conf, comment out the rsync entry:

chsubserver -r inetd -C /etc/inetd.conf -d -v 'rsync' -p 'tcp'
refresh -s inetd

Impact:

The rsync.rte fileset also provides the rsync client. If the client is required, stop and disable the rsync daemon and leave the fileset installed

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: 72a5db6013621563fe521074ca6c9cc8eecc6337995862aab300b1bdc0ad4746