Install firewalld Package
Ensures the firewalld host-based firewall package is installed so network access can be filtered by zone, port and service.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
firewalld provides a simple and effective way to block or limit remote access to the system by port, service and protocol. A host without a host-based firewall exposes every listening service to the network, widening the attack surface and making it far harder to enforce a least-exposure policy. Centralised, zone-based firewall rules let the system take enforcement action against unauthorised connections, which is required by CIS and PCI-DSS network-control baselines.
What Pavois checks
Pavois queries the package database through package('firewalld'), reporting whether the firewall software is actually present rather than inferring it from leftover zone files. This reflects the effective state: a system can have /etc/firewalld/ fragments yet no firewalld binary, and only a package-manager query tells the truth.
describe package('firewalld') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q firewalld. It passes when a versioned package name is printed (e.g. firewalld-1.x.x-x.elx.noarch) and fails on package firewalld is not installed. Confirm the service is running with systemctl is-active firewalld and inspect active rules with firewall-cmd --list-all.
Inspect & investigate
Install state: rpm -q firewalld. Runtime activity and rule reloads are visible via journalctl -u firewalld; dropped/rejected packets can be logged through firewalld's LogDenied setting and read in /var/log/messages or dmesg.
Remediation
Pavois's harden plan installs the firewalld package (resource package, action install) when you run pavois harden apply. Installing the package does not open or close any port by itself, you must enable the service (systemctl enable --now firewalld) and define the zones/services your host needs.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | firewalld |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without firewalld, all listening services are reachable from the network with no host-level filtering. Precaution before enabling: starting firewalld applies the default zone, which may drop traffic to ports you rely on, most importantly SSH (22/tcp). Before activating on a remote host, add the SSH service to the active zone (firewall-cmd --permanent --add-service=ssh) or you can lock yourself out. Verify rules with firewall-cmd --list-all before reloading.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 4.1.2, 4.1.1 | direct | per OS, see the benchmark table | high |
| PCI DSS | 1.2.1 | supporting | 4.0.1 | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.