AlmaLinux OS 9 must not have any telnet packages installed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-269404	ALMA-09-037860	SV-269404r1050287_rule		High

Description

Passwords must be protected at all times, and encryption is the standard method for protecting passwords. If passwords are not encrypted, they can be plainly read (i.e., clear text) and easily compromised. A telnet server provides an unencrypted remote access mechanism that does not protect the confidentiality of user credentials or the remote session. If a privileged user were to log on using this service, the privileged user password could be compromised. SSH or other encrypted session methods must be used instead. Removing the server and client packages prevents inbound and outbound communications from being compromised.

STIG	Date
CloudLinux AlmaLinux OS 9 Security Technical Implementation Guide	2025-05-22

Details

Check Text (C-73435r1049642_chk)

Verify that AlmaLinux OS 9 does not have a telnet client or server package installed with the following command:

$ rpm -qa | grep telnet

If the "telnet-server" server or "telnet" client packages are installed, this is a finding.

Note that there may be third-party or alternative packages that provide the same functionality, which should also be removed.

Fix Text (F-73336r1048589_fix)

Remove the default telnet client and server packages using the following command:

$ dnf remove telnet-server telnet