mediumservicesverified ✓rollback-safe
Ensure krb5-server package is not installed
pkg-krb5-server-absent · RHEL ≥ 8 · 2 impls
Description
The krb5-server package provides the Kerberos KDC and related services. Unless the system is a designated Kerberos server, this package should not be installed.
Rationale
Running unnecessary services increases the attack surface. The Kerberos server should only be installed on designated authentication servers.
Check → Remediate
Checkpackage_state
- name:
- krb5-server
- state:
- absent
Remediatepackage_absent
- name:
- krb5-server
Framework references
STIG
V-237640
NIST 800-53
CM-7AC-6
Live verification
rhel8:checkrhel9:check
#package#kerberos#attack-surface