← All rules
SOCLE-CLD-PKG-068// Packagesmediuminventory state

Install OpenSSH client software

Ensures the openssh-clients package (ssh, scp, sftp) is installed.

Checked against what is installed or registered, packages present/absent, account databases.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →
FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0

Why this rule matters

The openssh-clients package provides ssh, scp, and sftp, the utilities to make encrypted connections and transfer files securely to SSH servers. Without an SSH client, administrators are pushed toward unencrypted alternatives (telnet, FTP, rsh) that expose credentials and data in clear text on the network.

What Pavois checks

Pavois asks the package manager whether openssh-clients is installed via the InSpec package resource (effectively rpm -q openssh-clients). Querying installed-package state directly confirms the client binaries are present, rather than probing for individual tool paths.

describe package('openssh-clients') do
  it { should be_installed }
end

How to verify it is applied

Run rpm -q openssh-clients. The expected output is a versioned package name such as openssh-clients-8.x-.... The client can be confirmed with ssh -V.

Inspect & investigate

  • rpm -q openssh-clients, confirms the package is installed.
  • ssh -V, prints the OpenSSH client version.
  • rpm -qi openssh-clients, shows install date and source repository.

Remediation

Pavois's harden plan declares a package resource for openssh-clients with action install and applies it with pavois harden apply, which runs dnf install openssh-clients under the hood. No service restart is required.

Pavois applies this with its own harden engine, the plan below, not a shell script:

actioninstall
nameopenssh-clients
resourcepackage
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

Installing openssh-clients is non-disruptive: it adds client utilities without affecting the SSH server or any running service, so there is essentially no rollback risk. The only consideration is ensuring the package comes from a trusted repository.

Sources & references