Remove the Kerberos Server Package
Ensures the krb5-server Kerberos KDC package is not installed on hosts that are not dedicated KDCs.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
krb5-server provides the Kerberos Key Distribution Center (KDC) and admin server. Unnecessary packages should not be installed, to decrease the system's attack surface. While this software is essential on a dedicated KDC, it is not needed on typical desktops, workstations or application servers, where it would only add a privileged, network-facing service that could be misconfigured or exploited.
What Pavois checks
Pavois queries the package database via InSpec package('krb5-server') (rpm -q krb5-server) and asserts it is not installed. Reading the live RPM database is authoritative, it reflects exactly what is on disk, independent of whether the krb5kdc service happens to be running or masked.
describe package('krb5-server') do
it { should_not be_installed }
endHow to verify it is applied
Run rpm -q krb5-server. The expected output is package krb5-server is not installed. A version line like krb5-server-1.18.x-... means the rule fails.
Inspect & investigate
Confirm removal via dnf history or rpm -q --last krb5-server. If the KDC ran previously, journalctl -u krb5kdc and /var/log/krb5kdc.log hold its activity; /var/log/dnf.rpm.log records the uninstall transaction.
Remediation
Pavois's harden plan declares a package resource named krb5-server with action remove; pavois harden apply runs the equivalent of dnf remove krb5-server to reach the compliant state. If remediation were empty you would uninstall it manually.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | krb5-server |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing krb5-server deletes the KDC and admin server. Precaution: never apply this on a host that actually serves as a Kerberos KDC, doing so would break authentication for the entire realm, locking out every client that relies on it. Confirm the role first (systemctl is-enabled krb5kdc kadmin, check /var/kerberos/krb5kdc/). Removing the server package does not remove the krb5-workstation client tools, so Kerberos clients keep working.