Install OpenSSH client software
Ensures the openssh-clients package (ssh, scp, sftp) is installed.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
The openssh-clients package provides ssh, scp, and sftp, the utilities to make encrypted connections and transfer files securely to SSH servers. Without an SSH client, administrators are pushed toward unencrypted alternatives (telnet, FTP, rsh) that expose credentials and data in clear text on the network.
What Pavois checks
Pavois asks the package manager whether openssh-clients is installed via the InSpec package resource (effectively rpm -q openssh-clients). Querying installed-package state directly confirms the client binaries are present, rather than probing for individual tool paths.
describe package('openssh-clients') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q openssh-clients. The expected output is a versioned package name such as openssh-clients-8.x-.... The client can be confirmed with ssh -V.
Inspect & investigate
rpm -q openssh-clients, confirms the package is installed.ssh -V, prints the OpenSSH client version.rpm -qi openssh-clients, shows install date and source repository.
Remediation
Pavois's harden plan declares a package resource for openssh-clients with action install and applies it with pavois harden apply, which runs dnf install openssh-clients under the hood. No service restart is required.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | openssh-clients |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing openssh-clients is non-disruptive: it adds client utilities without affecting the SSH server or any running service, so there is essentially no rollback risk. The only consideration is ensuring the package comes from a trusted repository.