systemd services: 40 controls for Linux hardening

The domain in figures

What does Pavois check in this domain?

effective runtime 40

Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.

Which standards does this domain cover?

One effective-configuration check serves as evidence for several standards at once. The references below are the ones the corpus actually carries, never a claimed equivalence. how to read a standard mapping.

CIS

1.5.5, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9, 2.1.10, 2.1.11, 2.1.12, 2.1.13, 2.1.14, 2.1.15, 2.1.16, 2.1.17, 2.1.18, 2.1.19, 2.2.4, 2.4.1.1, 3.1.3, 6.1.1.1, 6.1.2.1.3, 6.2.1.1, 6.2.1.1.1, 6.2.1.2, 6.2.1.2.3, 6.2.2.1.3, 6.3.1.2, 6.3.1.4, 10.2.1

ANSSI BP-028

R33, R67

NIST 800-53

3.1.13, 3.1.16, 3.3.1, 3.4.5, 3.4.6, 3.4.7, AC-2(g), AC-6(9), AC-18(3), AC-18(a), AU-2(d), AU-3, AU-4(1), AU-10, AU-12(c), AU-14(1), CM-6(a), CM-7(a), CM-7(b), IA-5(10), MP-7, SC-8, SC-8(1), SC-8(2), SC-8(3), SC-8(4), SC-24, SI-4(23)

PCI DSS

2.2.4, 10.2.1

DISA STIG

UBTU-22-213015, UBTU-22-254015, UBTU-22-255015, UBTU-22-653015, UBTU-24-100050, UBTU-24-100410, UBTU-24-100660, UBTU-24-100810, UBTU-24-600070

The 40 controls of the systemd services domain

Sources & references

Full control catalogue · All control domains