# Ensure rsh client is not installed

Necessity: The Remote Shell (rsh) protocol is obsolete and highly insecure. It transmits all data, including usernames and passwords, in cleartext across the network, making it trivial for an attacker to eavesdrop and capture credentials. Its presence on a system introduces a significant security risk and increases the attack surface, as it could be used maliciously to connect to legacy systems. The secure, modern replacement for rsh is the Secure Shell (SSH) protocol.

Auditing and Remediation: The audit script queries the system's package manager (dpkg) to determine if the 'rsh-client' package is installed. The remediation script uses the package manager (apt-get) to permanently purge the 'rsh-client' package and its associated configuration files from the system.

Recommended State Rationale: The recommended state for all security levels (Basic, Moderate, and Strict) is 'Not Installed'. There is no legitimate use case for the rsh client in a modern security context. Its protocol is fundamentally broken from a security perspective. Therefore, the only acceptable configuration is its complete removal to eliminate the associated risks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks if the 'rsh-client' package is installed using the `dpkg-query` command. The script must output only the string 'Installed' if the package is present, or 'Not Installed' if it is not, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional argument, which will be the desired state ('Not Installed'). If the argument is 'Not Installed', the script must use `apt-get purge -y rsh-client` to completely remove the package. The script must output `true` on successful removal or if the package was already absent, and `false` if the removal fails.

