← All control domains
Hardening (misc): 28 controls for Linux hardening
Pavois audits 28 controls in the Hardening (misc) hardening domain, across 9 systems and 5 standards (CIS, ANSSI BP-028, NIST 800-53, PCI DSS, DISA STIG). Every control declares the evidence it gathers, its severity, its remediation and its standard references.
The domain in figures
| Controls | 28 |
| Severities | |
| Evidence gathered | |
| Standards | |
| Systems | Debian 12Debian 13FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8RHEL 9 / Rocky 9 / AlmaLinux 9Ubuntu 22.04Ubuntu 24.04Ubuntu 26.04 |
| Coverage depth | in depth |
What does Pavois check in this domain?
- effective runtime 11
- Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
- persistent config 7
- Checked against the content of a persistent configuration file, the source of truth that survives reboots.
- inventory state 7
- Checked against what is installed or registered, packages present/absent, account databases.
- filesystem state 3
- Checked against a path’s metadata, mode, owner, group, SUID/SGID.
Which standards does this domain cover?
One effective-configuration check serves as evidence for several standards at once. The references below are the ones the corpus actually carries, never a claimed equivalence. how to read a standard mapping.
- CIS
- 1.3.1.3, 1.3.1.4, 1.3.3, 1.4.2, 2.1.21, 2.1.23, 2.2.6, 3.1.2, 5.1.4, 5.1.6, 5.1.7, 5.1.10, 5.1.12, 5.2.7, 5.3.3.4.3, 5.4.2.3, 5.4.2.4, 5.4.2.7, 5.4.3.1, 5.4.3.2, 6.1.1, 6.3.1, 6.3.2, 7.2.4, 7.2.5, 7.2.6, 7.2.9, 7.2.10, 8.2.1, 8.2.2, 8.3.1, 8.3.2, 8.6.1, 11.5.2
- ANSSI BP-028
- R1, R32, R33, R45, R67, R68, R74, R76
- NIST 800-53
- 3.1.1, 3.1.11, 3.1.12, 3.1.16, 3.13.11, AC-2(5), AC-3, AC-3(4), AC-6, AC-6(8), AC-6(10), AC-12, AC-17(a), AC-18(3), AC-18(a), CM-6, CM-6(a), CM-6(b), CM-7(2), CM-7(5)(b), CM-7(a), CM-7(b), IA-2, IA-5(1)(c), IA-5(7), IA-5(c), IA-5(h), MP-7, SC-7(21), SC-10, SC-12(3), SI-7, SI-7(1)
- PCI DSS
- 1.3.3, 1.4.2, 2.2.6, 8.2.1, 8.2.2, 8.3.1, 8.3.2, 8.6.1, 11.5.2
- DISA STIG
- UBTU-22-291015, UBTU-22-412030, UBTU-22-431015, UBTU-22-651015, UBTU-24-100110, UBTU-24-100120, UBTU-24-100510, UBTU-24-200060, UBTU-24-600230