Uninstall nginx Package
Removes the nginx web/reverse-proxy package when the host has no need to serve web content.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The nginx package installs a web/reverse-proxy server that, once started, listens for inbound connections and exposes a network-facing service. Per the principle of least functionality (NIST CM-7), software that is not required should not be present. If there is no need to make web server software available on this host, removing it provides a safeguard against its activation, removes a frequently targeted listening service, and eliminates a class of web vulnerabilities and misconfigurations from the attack surface.
What Pavois checks
Pavois queries the package database through the InSpec package('nginx') resource and asserts should_not be_installed, resolving via dpkg/rpm. Reading the effective package inventory is more reliable than checking whether nginx is currently listening on port 80/443: a stopped service is still installed and can be re-enabled, and config under /etc/nginx/ does not prove the binary is gone. The package state is the ground truth for least-functionality compliance.
describe package('nginx') do
it { should_not be_installed }
endHow to verify it is applied
RHEL: rpm -q nginx should print package nginx is not installed. Debian/Ubuntu: dpkg -s nginx should report not installed. Confirm nothing listens on the web ports with ss -lntp | grep -E ':80|:443' (no nginx process expected).
Inspect & investigate
Removal is logged in /var/log/dpkg.log (Debian/Ubuntu) or dnf history (RHEL). Prior nginx activity, access and error events, appears in /var/log/nginx/access.log, /var/log/nginx/error.log and journalctl -u nginx. After removal no nginx unit should remain.
Remediation
Pavois's harden plan declares a package resource for nginx with action remove; pavois harden apply uninstalls it via the native package manager (apt/dnf), which also stops the nginx service. Depending on distro packaging, config under /etc/nginx/ may be left behind (e.g. apt without purge); remove it manually if you want a clean state.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | nginx |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If this host actually serves web content or acts as a reverse proxy/load balancer, removing nginx takes those sites and routes offline. Precautions: before applying, confirm the host has no web-serving role, check ss -lntp for listeners on 80/443 and review /etc/nginx/. If nginx is required, do not remove it; instead harden the configuration (disable unused modules, restrict listeners). On hosts with no web role, removal is safe and enforces least functionality.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.18, 2.1.19 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.