NET0744 - BSDr commands are not disabled - rcp-enable

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The administrator must ensure BSD r command services are disabled.

Berkeley Software Distribution (BSD) 'r' commands allow users to execute commands on remote systems using a variety of protocols. The BSD 'r' commands (e.g., rsh, rlogin, rcp, rdump, rrestore, and rdist) are designed to provide convenient remote access without passwords to services such as remote command execution (rsh), remote login (rlogin), and remote file copy (rcp and rdist). The difficulty with these commands is that they use address-based authentication. An attacker who convinces a server that he is coming from a 'trusted' machine can essentially get complete and unrestricted access to a system. The attacker can convince the server by impersonating a trusted machine and using IP address, by confusing DNS so that DNS thinks that the attacker's IP address maps to a trusted machine's name, or by any of a number of other methods.

NOTE: These commands have been disabled by default in IOS since version 12.0.

Solution

Configure the device to disable BSDr command services.

See Also

https://iasecontent.disa.mil/stigs/zip/U_Network_L2_Switch_V8R27_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7, CAT|II, CSCv6|9.1, Rule-ID|SV-15314r2_rule, STIG-ID|NET0744, Vuln-ID|V-14669

Plugin: Cisco

Control ID: d5b1fd998f2ab58ad213ebadc9c9a111166ba6a92924477ad109ec4fbfb5f87e