documentation_complete: true

title: 'Disable rexec Service'

description: |-
    The <tt>rexec</tt> service, which is available with
    the <tt>rsh-server</tt> package and runs as a service through xinetd,
    should be disabled.
    <chkconfig-service-macro enable="false" service="rexec" />

rationale: |-
    The rexec service uses unencrypted network communications, which
    means that data from the login session, including passwords and
    all other information transmitted during the session, can be
    stolen by eavesdroppers on the network.

severity: high

identifiers:
    cce: 27208-8

references:
    disa: 68,1436
    nist: CM-7
    srg: SRG-OS-000033
    stigid: RHEL-06-000216

ocil: '<xinetd-service-check-macro enable="false" service="rexec" />'
