Ensure nss-tools is installed
Ensures the nss-tools package (NSS certificate/key database command-line tools) is installed.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
Network Security Services (NSS) is a set of libraries for cross-platform development of security-enabled client and server applications. The nss-tools package installs the command-line utilities (certutil, modutil, pk12util, etc.) needed to manage the NSS certificate and key databases. Without these tools, administrators cannot inspect, import, or maintain the certificates that many RHEL services rely on, hampering certificate hygiene and incident response.
What Pavois checks
Pavois asks the package manager whether nss-tools is installed via the InSpec package resource (effectively rpm -q nss-tools). Querying installed-package state directly reflects which binaries are actually available on the host, which is more reliable than probing for individual tool paths that vary across releases.
describe package('nss-tools') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q nss-tools. The expected output is a versioned package name such as nss-tools-3.90.0-.... The CLI tools are then available, e.g. certutil -H.
Inspect & investigate
rpm -q nss-tools, confirms the package is installed.rpm -qi nss-tools, shows install date and source repository.certutil -L -d <nssdb>, lists certificates in a given NSS database (proves the tools work).
Remediation
Pavois's harden plan declares a package resource for nss-tools with action install and applies it with pavois harden apply, which runs dnf install nss-tools under the hood. No service restart is required.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | nss-tools |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing nss-tools is non-disruptive: it only adds command-line utilities and does not change any running service. There is essentially no rollback risk. The only consideration is the minor disk footprint and ensuring the package comes from a trusted repository.