Install libreswan Package
Ensures the libreswan IPsec/IKE package is installed so the host can establish encrypted VPN tunnels.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
libreswan provides an IPsec/IKE implementation used to build encrypted VPN tunnels. Offering remote users and systems the ability to initiate a secure VPN connection protects data in transit across untrusted or wide-area networks. Without an IPsec stack installed, the host cannot terminate or originate IPsec tunnels, forcing traffic over the network in cleartext or pushing it onto less-controlled tunneling tools.
What Pavois checks
Pavois asks the package database directly via the InSpec package('libreswan') resource and asserts should be_installed. On RHEL 9 this resolves through rpm/dnf, reflecting the effective package state rather than a guess based on the presence of a config file like /etc/ipsec.conf. A leftover config file does not mean the IPsec stack is actually present, so querying the resolved package inventory is more reliable.
describe package('libreswan') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q libreswan. Applied looks like libreswan-4.x-...el9.x86_64; not applied returns package libreswan is not installed. You can also confirm the service unit exists with systemctl status ipsec.
Inspect & investigate
Installation is recorded by the package manager: dnf history and rpm -q --last libreswan show when it was added. IPsec activity and IKE negotiation errors land in journalctl -u ipsec (pluto daemon).
Remediation
Pavois's harden plan declares a package resource for libreswan with action install, so running pavois harden apply installs it through the native package manager (dnf/rpm). Installing the package alone does not create any VPN tunnel; you still configure /etc/ipsec.conf, the connection definitions and enable the ipsec service separately.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | libreswan |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Without an IPsec implementation the host cannot build encrypted tunnels and remote traffic may traverse the network unprotected. Precautions: this rule only installs the package; it does not start ipsec or open any tunnel, so applying it is low-risk. Note it pulls in a network daemon and dependencies, review and configure connections before enabling the service, and ensure firewall rules permit the required IKE/ESP traffic (UDP 500/4500, protocol 50) only where intended.