Uninstall krb5-workstation Package
Ensures the krb5-workstation Kerberos client package is not installed on hosts that do not use Kerberos authentication.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
Kerberos is a network authentication system. The krb5-workstation package contains the basic Kerberos client programs (kinit, klist, kdestroy, kpasswd). Older versions relied on weak ciphers (e.g. single-DES) and the package is unnecessary on systems that do not authenticate against a Kerberos realm; removing it reduces the attack surface and removes credential-handling tooling an attacker could misuse.
What Pavois checks
Pavois queries the package database via InSpec package('krb5-workstation') (rpm -q krb5-workstation) and asserts it is not installed. The live RPM database is authoritative: it tells you exactly which client binaries (kinit, klist…) are present, regardless of any /etc/krb5.conf left behind.
describe package('krb5-workstation') do
it { should_not be_installed }
endHow to verify it is applied
Run rpm -q krb5-workstation. The expected output is package krb5-workstation is not installed. A version line like krb5-workstation-1.18.x-... means the rule fails.
Inspect & investigate
Confirm removal via dnf history or rpm -q --last krb5-workstation. /var/log/dnf.rpm.log records the uninstall transaction. There is no dedicated service log, since these are command-line client tools.
Remediation
Pavois's harden plan declares a package resource named krb5-workstation with action remove; pavois harden apply runs the equivalent of dnf remove krb5-workstation to reach the compliant state. If remediation were empty you would uninstall it manually.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | krb5-workstation |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing krb5-workstation deletes the Kerberos client tools. Precaution: do not apply on hosts that authenticate users or services against a Kerberos/Active Directory realm (e.g. via sssd, NFS with sec=krb5, or SSH GSSAPI), removing it would break Kerberos logins and ticket acquisition, potentially locking out users. Check /etc/krb5.conf, realm list and SSSD config before applying.