Ensure gnutls-utils is installed
Ensures the gnutls-utils package is installed, providing the TLS/certificate inspection command-line tools.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
gnutls-utils provides command-line tools (certtool, gnutls-cli, gnutls-serv) for inspecting certificates and testing TLS endpoints. Having them available lets administrators verify certificate validity, expiry and TLS configuration as part of routine assurance and incident response. Without these tools, validating the cryptographic posture of services on the host is harder, weakening the ability to detect misconfigured or weak TLS.
What Pavois checks
Pavois queries package('gnutls-utils') directly against the package database, reporting the effective install state rather than inferring it from the presence of GnuTLS libraries. A linked library does not mean the CLI tools are available; only a package query confirms the utilities can actually be run.
describe package('gnutls-utils') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q gnutls-utils. The rule passes when a versioned name is printed (e.g. gnutls-utils-3.x.x-x.elx.x86_64) and fails on package gnutls-utils is not installed. You can also confirm the tools work with certtool --version.
Inspect & investigate
Install state: rpm -q gnutls-utils. There is no dedicated service log; package install/removal is recorded in /var/log/dnf.log and dnf history.
Remediation
Pavois's harden plan installs the gnutls-utils package (resource package, action install) when you run pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | gnutls-utils |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Misconfiguration impact: without these tools, certificate and TLS verification on the host is harder, slowing assurance and incident response. Precaution: installing gnutls-utils is low-risk, it only adds command-line tools and does not change any running service or default crypto policy.