Uninstall gssproxy Package
Removes the gssproxy GSS-API credential proxy on hosts that do not need Kerberos/NFS GSS support.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
gssproxy is a proxy for GSS-API credential handling used mainly with Kerberos and NFS. Kerberos relies on key-derivation functions that may not be compatible with stricter site policies such as FIPS 140, and an unused credential-handling daemon is extra attack surface. On hosts that do not require Kerberos/NFS GSS support, removing it follows least-functionality and avoids running a service nobody manages.
What Pavois checks
Pavois queries package('gssproxy') against the package database to report the effective install state. This is more dependable than checking whether the gssproxy.service unit is enabled, because the package, and its binary, can still be present and triggerable even when the service is masked.
describe package('gssproxy') do
it { should_not be_installed }
endHow to verify it is applied
Run rpm -q gssproxy. The rule passes when it prints package gssproxy is not installed.
Inspect & investigate
Confirm removal with rpm -q gssproxy. If still present, its activity is in journalctl -u gssproxy; removal is recorded in /var/log/dnf.log and dnf history.
Remediation
Pavois's harden plan removes the gssproxy package (resource package, action remove) when you run pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | gssproxy |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Precaution before removing: gssproxy is required for Kerberized NFS (e.g. nfs-utils with sec=krb5) and some GSS-API services. Verify the host is not a Kerberos client/server and does not mount NFS with GSS security before removing, otherwise NFS mounts or Kerberos-authenticated services may fail. On hosts with no such role, removal is safe and reduces attack surface.