Fix the service_telnet_disabled rule

[marcusburghardt]

Description:

The description and the package name are now correct.

Rationale:

This rule was failing because the packagename is different than the servicename.
Also, the description was not accurate.

Related to #10026

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_service_telnet_disabled'.
--- xccdf_org.ssgproject.content_rule_service_telnet_disabled
+++ xccdf_org.ssgproject.content_rule_service_telnet_disabled
@@ -3,31 +3,15 @@
 Disable telnet Service
 
 [description]:
-The telnet service configuration file /etc/xinetd.d/telnet
-is not created automatically. If it was created manually, check the
-/etc/xinetd.d/telnet file and ensure that disable = no
-is changed to read disable = yes as follows below:
-
-# description: The telnet server serves telnet sessions; it uses \\
-# unencrypted username/password pairs for authentication.
-service telnet
-{
- flags = REUSE
- socket_type = stream
-
- wait = no
- user = root
- server = /usr/sbin/in.telnetd
- log_on_failure += USERID
- disable = yes
-}
-
-If the /etc/xinetd.d/telnet file does not exist, make sure that
-the activation of the telnet service on system boot is disabled
-via the following command:
-
-The rexec socket can be disabled with the following command:
-$ sudo systemctl mask --now rexec.socket
+Make sure that the activation of the telnet service on system boot is disabled.
+
+The telnet socket can be disabled with the following command:
+$ sudo systemctl mask --now telnet.socket
+
+[warning]:
+If the system relies on xinetd to manage telnet sessions, ensure the telnet service
+is disabled by the following line: disable = yes. Note that the xinetd file for
+telnet is not created automatically, therefore it might have different names.
 
 [reference]:
 1
@@ -393,11 +377,10 @@
 PR.PT-4
 
 [rationale]:
-The telnet protocol uses unencrypted network communication, which
-means that data from the login session, including passwords and
-all other information transmitted during the session, can be
-stolen by eavesdroppers on the network. The telnet protocol is also
-subject to man-in-the-middle attacks.
+The telnet protocol uses unencrypted network communication, which means that data from the
+login session, including passwords and all other information transmitted during the session,
+can be stolen by eavesdroppers on the network. The telnet protocol is also subject to
+man-in-the-middle attacks.
 
 [ident]:
 CCE-80887-3

OVAL for rule 'xccdf_org.ssgproject.content_rule_service_telnet_disabled' differs.
--- oval:ssg-service_telnet_disabled:def:1
+++ oval:ssg-service_telnet_disabled:def:1
@@ -1,5 +1,5 @@
 criteria OR
-criterion oval:ssg-test_service_telnet_package_telnet_removed:tst:1
+criterion oval:ssg-test_service_telnet_package_telnet-server_removed:tst:1
 criteria AND
 criterion oval:ssg-test_service_not_running_telnet:tst:1
 criterion oval:ssg-test_service_loadstate_is_masked_telnet:tst:1

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

[marcusburghardt]

Automatus CI tests are failing because the containers are not using systemd:

STDERR: Warning: Permanently added '[localhost]:42351' (ECDSA) to the list of known hosts.
+ SYSTEMCTL_EXEC=/usr/bin/systemctl
+ /usr/bin/systemctl -q list-unit-files telnet.service
+ /usr/bin/systemctl unmask telnet.service
+ /usr/bin/systemctl start telnet.service
System has not been booted with systemd as init system (PID 1). Can't operate.

[vojtapolasek]

Thank you for the changes. Everything is almost perfect. There is just small nitpick to be fixed.

[vojtapolasek]

Justa nitpick - when combined with the macron on the next line, the "following command" phrase is there twice. Try to compile te content and look in the HTML guide.

[marcusburghardt]

Hi @vojtapolasek , this was probably there even before the changes in this PR. In any case, let me check and fix. Thanks for noticing this.

[marcusburghardt]

It is fixed now.

[codeclimate]

Code Climate has analyzed commit 3362e72 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 49.9% (0.0% change).

View more on Code Climate.

[vojtapolasek]

/retest

[vojtapolasek]

Looks good now. Thank you.