← Full control catalogue
The 34 Linux hardening control domains
The 790 controls Pavois audits are filed under 34 domains, from SSH hardening to kernel build options, 40 of them high or critical severity. Each domain has its own page: its controls, its standards, the evidence it gathers and the real depth of its coverage.
| Domain | Controls | High/critical | OS | Standards | Coverage |
|---|---|---|---|---|---|
| File ownership | 128 | 0 | 9 | in depth | |
| Packages | 120 | 13 | 9 | in depth | |
| Kernel & network (sysctl) | 70 | 0 | 9 | in depth | |
| File permissions | 66 | 0 | 9 | in depth | |
| Kernel build | 62 | 3 | 9 | in depth | |
| systemd services | 40 | 2 | 9 | in depth | |
| Mounts | 38 | 0 | 9 | in depth | |
| SSH | 37 | 2 | 9 | in depth | |
| Hardening (misc) | 28 | 3 | 9 | in depth | |
| Kernel modules | 23 | 0 | 9 | in depth | |
| Audit (auditd) | 22 | 0 | 9 | in depth | |
| GNOME desktop (dconf) | 19 | 2 | 9 | in depth | |
| Kernel command line | 18 | 2 | 9 | in depth | |
| Passwords (pwquality) | 14 | 0 | 9 | in depth | |
| Audit (auditd daemon) | 13 | 0 | 9 | in depth | |
| Hardening (posture) | 13 | 4 | 9 | in depth | |
| Accounts (PAM modules) | 12 | 1 | 9 | in depth | |
| Filesystem (scan) | 11 | 0 | 9 | in depth | |
| Sudo | 10 | 1 | 9 | in depth | |
| Accounts (login.defs) | 8 | 0 | 9 | in depth | |
| Accounts | 6 | 4 | 9 | in depth | |
| Accounts (home dirs) | 6 | 0 | 9 | in depth | |
| Accounts (umask) | 4 | 0 | 9 | in depth | |
| Cron/at access control | 4 | 0 | 9 | in depth | |
| Accounts (faillock) | 3 | 0 | 9 | in depth | |
| Banners | 3 | 0 | 9 | in depth | |
| Logging (journald) | 3 | 0 | 9 | partial | |
| Accounts (password history) | 2 | 0 | 9 | in depth | |
| Firewall | 2 | 1 | 9 | shallow | |
| Accounts (root PATH) | 1 | 0 | 9 | in depth | |
| Bootloader (grub) | 1 | 1 | 9 | in depth | |
| Logging | 1 | 0 | 9 | partial | |
| Mandatory Access Control | 1 | 1 | 4 | in depth | |
| Time synchronization | 1 | 0 | 9 | shallow |