Install cryptsetup Package
Ensures the cryptsetup package is installed so administrators can create and manage LUKS encrypted volumes for data-at-rest protection.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
LUKS is the standard for Linux disk encryption. By providing a standard on-disk format it not only eases compatibility across distributions but also enables secure management of multiple user passphrases. Unlike older solutions, LUKS stores all setup information in the partition header, letting users transport or migrate encrypted data seamlessly. LUKS for dm-crypt is implemented in cryptsetup.
What Pavois checks
Pavois verifies that the cryptsetup package is present via rpm. The tooling must be installed for disk encryption to be available; this check confirms the capability exists (it does not itself prove that any volume is currently encrypted).
describe package('cryptsetup') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q cryptsetup, which should return an installed version. To check that volumes are actually encrypted, list them with lsblk --fs and confirm LUKS headers via cryptsetup luksDump /dev/<device>.
Inspect & investigate
Confirm presence with rpm -q cryptsetup; LUKS mapping and unlock events appear via journalctl -b | grep -i luks and active mappings via dmsetup ls --target crypt.
Remediation
Pavois's harden plan installs the cryptsetup package (resource package, action install) and is applied with pavois harden apply. Installing the tooling does not encrypt existing disks, that is a deliberate, data-destructive operation an administrator must perform separately.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | cryptsetup |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without cryptsetup, full-disk encryption is unavailable and data at rest is exposed if a disk is stolen or decommissioned. Installing the package is safe and non-disruptive. Encrypting an existing volume, however, requires reformatting and will destroy data, always back up first, plan an unlock mechanism (passphrase or keyfile/TPM), and account for the boot-time passphrase prompt on headless systems.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| PCI DSS | 3.5.1.2 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.