Uninstall httpd Package
Removes the Apache httpd web server on hosts that are not meant to serve web content.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
httpd is the Apache web server. A web server listening on a host that is not meant to serve web content is an unnecessary network-facing service: it exposes ports, ships a large codebase prone to vulnerabilities, and can be started accidentally. If there is no need to make web-server software available, removing it provides a safeguard against its activation and shrinks the attack surface, in line with the least-functionality principle (CIS / NIST CM-7).
What Pavois checks
Pavois queries package('httpd') against the package database to report the effective install state. This beats checking whether the service is currently running: a stopped-but-installed httpd can be started by any later action or dependency, so the package's presence, not its momentary state, is what matters.
describe package('apache2') do
it { should_not be_installed }
endHow to verify it is applied
On RHEL-family run rpm -q httpd; on Debian/Ubuntu the equivalent package is apache2, so run dpkg -s apache2. The rule passes when the result is package ... is not installed.
Inspect & investigate
Confirm removal with rpm -q httpd / dpkg -s apache2. If present, web-server activity is in journalctl -u httpd / journalctl -u apache2 and the access/error logs under /var/log/httpd/ or /var/log/apache2/; removal is recorded in /var/log/dnf.log or /var/log/dpkg.log.
Remediation
Pavois's harden plan removes the httpd package (resource package, action remove) when you run pavois harden apply. Removing the package stops and uninstalls the web server.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | apache2 |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Do not apply on a host whose role is to serve web content, removing httpd/apache2 will take down all hosted sites and may remove dependent modules. Precaution: confirm no application, reverse proxy or virtual host depends on Apache before removing; if a web server is genuinely needed, keep it and instead harden its configuration. On non-web hosts, removal is safe and recommended.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.18, 2.1.19 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.