In the previous part

Disabling and Removing Unnecessary Services

was completed.

1. CIS Benchmark Requirements (Section 2.2)

This section of the standard focuses on configuring and removing unnecessary client software and tools:

• 2.2.1 Ensure ftp client is not installed (Automated)
• 2.2.2 Ensure ldap client is not installed (Automated)
• 2.2.3 Ensure nis client is not installed (Automated)
• 2.2.4 Ensure telnet client is not installed (Automated)
• 2.2.5 Ensure tftp client is not installed (Automated)

2. Concept & Rationale

Concept: The presence of client tools for network services on the server—even if the corresponding server-side service is inactive—constitutes a security risk. Should the server be compromised, an attacker can exploit these tools for lateral movement within the network (Lateral Movement) or data extraction (Data Exfiltration).

Security Reason: Protocols like FTP, Telnet, and TFTP transmit information (including usernames and passwords) in clear-text without encryption, making them highly vulnerable to eavesdropping attacks. NIS is an obsolete and insecure protocol.

3. Oracle Database Compatibility Check (RAC, ASM, Grid)

• General Status (No Conflict): There are no conflicts. The Oracle Database and Grid Infrastructure use secure protocols such as SSH, SCP, and SFTP for file transfer, installation, or management. FTP, Telnet, TFTP, and NIS clients are absolutely not required for Oracle's function, and their removal is completely safe.
• Note on LDAP (openldap-clients package): Only refrain from removing this package if your organization's infrastructure uses an LDAP server for centralized operating system user authentication. Otherwise (which is the case for most isolated database servers), its removal is completely safe and highly recommended.

4. Checking the Current Status (Audit Script)

Use the following script to check for the existence of these clients on the server:

GitHub link:

modules/audit_11_Remove_Unused_Clients.sh

If you are not familiar with bash scripts, you can refer to the training material I have published on the site for database administrators.

Bash for Oracle DBAs

#!/bin/bash
# Script: audit11.sh
# Purpose: Audit for Service Clients (CIS 2.2)

echo "=========================================================================="
echo " CIS Requirement: 2.2 Service Clients"
echo " - Ensure unnecessary client packages are not installed."
echo " Oracle Context:"
echo " - Oracle DB/Grid uses SQL*Net and built-in LDAP resolution libraries."
echo " - OS-level clients like ftp, telnet, and openldap-clients are NOT needed."
echo "=========================================================================="

FAIL_COUNT=0
CLIENT_PACKAGES=(ftp openldap-clients ypbind telnet tftp)

echo -e "\n[*] Auditing Service Clients..."
for pkg in "${CLIENT_PACKAGES[@]}"; do
    if rpm -q "$pkg" &>/dev/null; then
        echo -e "  \e[31m[FAIL]\e[0m Package '$pkg' is INSTALLED."
        FAIL_COUNT=$((FAIL_COUNT + 1))
    else
        echo -e "  \e[32m[PASS]\e[0m Package '$pkg' is NOT installed."
    fi
done

if [ "$FAIL_COUNT" -eq 0 ]; then
    echo -e "\n\e[32m[+] AUDIT RESULT: PASS\e[0m"
else
    echo -e "\n\e[31m[-] AUDIT RESULT: FAIL ($FAIL_COUNT issues found)\e[0m"
fi

5. Applying the Configuration (Remediation Bash Script)

The following script automatically removes all insecure and unnecessary client packages from the operating system:

GitHub link:

modules/remediate_11_Remove_Unused_Clients.sh

#!/bin/bash
# Script: remediation11.sh
# Purpose: Remove unnecessary service clients (CIS 2.2)

if [ "$EUID" -ne 0 ]; then
    echo "Please run as root"
    exit 1
fi

echo "=========================================================================="
echo " Applying Remediation for CIS 2.2 (Service Clients)"
echo " Oracle Context: Safe for DB/RAC. No dependencies on these legacy clients."
echo "=========================================================================="

CLIENT_PACKAGES=(ftp openldap-clients ypbind telnet tftp)

echo -e "\n[*] Removing unnecessary service clients..."
for pkg in "${CLIENT_PACKAGES[@]}"; do
    if rpm -q "$pkg" &>/dev/null; then
        dnf remove -y "$pkg" > /dev/null 2>&1
        echo -e "  \e[32m[OK]\e[0m Removed '$pkg'"
    else
        echo -e "  \e[32m[OK]\e[0m Package '$pkg' is already removed or not installed."
    fi
done

echo -e "\n\e[32m[+] REMEDIATION APPLIED SUCCESSFULLY\e[0m"

Note: If you are using organizational LDAP, exclude the openldap-clients package from the list above.

In the next part, we will move on to

Configuring Time Synchronization

.