Install dnf-plugin-subscription-manager Package
Ensures the dnf-plugin-subscription-manager package is installed so RHEL can access entitled repositories and receive supported security updates.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
This package provides plugins to interact with repositories and subscriptions from the Red Hat entitlement platform; it contains the subscription-manager and product-id plugins, which are required to receive supported security updates.
What Pavois checks
Pavois verifies that the dnf-plugin-subscription-manager package is present via rpm. Without the subscription-manager plugin, a registered RHEL host cannot resolve entitled repositories, so security patches never reach dnf, a silent supply gap that file scanners would not flag.
only_if { file('/etc/redhat-release').content.to_s =~ /Red Hat/ }
describe package('dnf-plugin-subscription-manager') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q dnf-plugin-subscription-manager, which should return an installed version. Confirm the host is registered and entitled with subscription-manager status (expected Overall Status: Current).
Inspect & investigate
Confirm the package with rpm -q dnf-plugin-subscription-manager; entitlement and registration events are recorded in /var/log/rhsm/rhsm.log and repository resolution is visible in dnf repolist.
Remediation
Pavois's harden plan installs the dnf-plugin-subscription-manager package (resource package, action install) and is applied with pavois harden apply. After installation, register the host with subscription-manager register to actually enable entitled repositories.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | dnf-plugin-subscription-manager |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without this plugin, a RHEL host cannot consume Red Hat entitled repositories, leaving it unable to install supported security updates. Installing the package is non-disruptive. Note this matters only for hosts entitled through Red Hat Subscription Management; systems using Satellite, a local mirror, or a RHEL-compatible distro (AlmaLinux/Rocky) may legitimately not need it.