← All control domains
Firewall: 2 controls for Linux hardening
Pavois audits 2 controls in the Firewall hardening domain, across 9 systems and 5 standards (CIS, ANSSI BP-028, NIST 800-53, PCI DSS, DISA STIG). Every control declares the evidence it gathers, its severity, its remediation and its standard references.
This domain is thinly covered by Pavois today, see the Coverage page.
The domain in figures
| Controls | 2 |
| Severities | |
| Evidence gathered | |
| Standards | |
| Systems | Debian 12Debian 13FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8RHEL 9 / Rocky 9 / AlmaLinux 9Ubuntu 22.04Ubuntu 24.04Ubuntu 26.04 |
| Coverage depth | shallow |
What does Pavois check in this domain?
- effective runtime 2
- Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Which standards does this domain cover?
One effective-configuration check serves as evidence for several standards at once. The references below are the ones the corpus actually carries, never a claimed equivalence. how to read a standard mapping.
- CIS
- 4.1.1, 4.1.2, 4.1.3, 4.2.3, 4.2.7, 4.3.8, 4.4.2.1
- ANSSI BP-028
- R50
- NIST 800-53
- 3.1.3, CA-3(5), CM-6(a), CM-7(b), SC-7(23)
- PCI DSS
- 1.2.1, 1.3.1
- DISA STIG
- UBTU-22-251020, UBTU-24-100300
The 2 controls of the Firewall domain
| Ref | Rule | Sev. | OS | Standards |
|---|---|---|---|---|
| SOCLE-CLD-NET-002 | A host firewall is installed and active | high | 9 | |
| SOCLE-CLD-NET-001 | Ensure the Host Firewall Defaults to Deny (any backend) | medium | 8 |