# Ruleset for cis.pi
# Service|Test|String to Search|Rule Level|Msg if test pass|Msg is test fail
telnet|search|\\r\\n|2.2|Only use telnet if necessary, consider ssh|telnet appears to be 'wrapped'
telnet|searchif|banner|7.6|Create appropriate warning banners|
ftp|search|220|2.3|Only use telnet if necessary, consider ssh|ftp appears to be 'wrapped'
login|search|zwoi|2.4|Only use login/rlogin if necessary, consider ssh|login/rlogin appears to be 'wrapped'
name|find||3.x|Turn off services that are not commonly used|
shell|search|ANY|3.x|Turn off services that are not commonly used|shell appears to be 'wrapped'
exec|find|3.x|Turn off services that are not commonly used|exec/rexec should not be running|
uucp|search|login|3.1|Turn off services that are not commonly used|uucp appears to be 'wrapped'
systat|find||3.x|Turn off services that are not commonly used|
netstat|search|zwoi|3.x|Turn off services that are not commonly used|
time|find||3.x|Turn off services that are not commonly used|
nfs|find||3.3|Disable NFS server process, if possible|
echo|find||3.x|Turn off services that are not commonly used|
discard|find||3.x|Turn off services that are not commonly used|
daytime|find||3.x|Turn off services that are not commonly used|
chargen|search|0123|3.x|Turn off services that are not commonly used|chargen appears to be 'wrapped'
rusersd|find||3.x|Turn off services that are not commonly used|
sprayd|find||3.x|Turn off services that are not commonly used|
rwall|find||3.x|Turn off services that are not commonly used|
rexd|find||3.x|Turn off services that are not commonly used|
smb|search|has no password|8.3|Verify that there are no accounts with empty password
telnet|search|trusts the world|8.3|Verify that there are no accounts with empty passwords
comsat|find||3.x|Turn off services that are not commonly used|
talk|find||3.x|Turn off services that are not commonly used|
ntalk|find||3.x|ntalk service should not be running|
tftp|find||2.5|Only use tftp if necessary|
finger|search|zcio|3.x|Turn off services that are not commonly used|finger appears to be wrapped
ttdbserverd|find||2.8|Only use CDE related daemons if necessary|
kcms_server|find||2.8|Only use CDE related daemons if necessary|
fs|find||2.8|Only use CDE related daemons if necessary|
kerbd|find||2.9|Only enable Kerberos related daemons if necessary|
printer|find||2.6|Only use printer service if necessary|
rpc.cmsd|find||3.x|Turn off services that are not commonly used|
sadmind|find||3.x|Turn off services that are not commonly used|
snmp|find||3.11|Disable SNMP, if possible|
dmi|find||3.x|Turn off services that are not commonly used|
dhcpv6-server||3.x|Turn off services that are not commonly used|
netbios-ssn|find||3.x|Turn off services that are not commonly used|
http|find||3.10|Disable Web server, if possible|
smtp|find||3.9|Disable email server if possible|
#smtp|search|overflow|S1|Sendmail version may be vulnerable|
#domain|search|vulnerable|S1|DNS may be vulnerable|
cachefsd|find||3.01|Turn off services that are not commonly used|
gssd|find||2.9|Only enable Kerberos related daemons if necessary|
ufsd|find||3.x|Turn off services that are not commonly used|
rquotad|find||2.7|Only use quotad if necessary|
walld|find||3.x|Turn off services that are not commonly used|
sprayd|find||3.x|Turn off services that are not commonly used|
#domain|search|Zone|S3|DNS allows zone transfers|
#smtp|search|VRFY|S3|smtp very/expn should not be enabled|
#nfs|search|export|S3nfs exports files without authentication|



