Install the OpenSSH Server Package
Ensures the openssh-server package (the sshd daemon for encrypted remote access) is installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The openssh-server package provides sshd, the daemon that allows encrypted remote administration. Without protection of the transmitted information, confidentiality and integrity may be compromised because unprotected communications can be intercepted and either read or altered. OpenSSH is the standard, hardened mechanism for secure remote access and replaces clear-text protocols like telnet and rsh.
What Pavois checks
Pavois asks the package manager whether openssh-server is installed via the InSpec package resource (rpm -q openssh-server on RHEL, dpkg-query -W openssh-server on Ubuntu). Querying installed-package state directly confirms sshd is present, rather than guessing from the existence of /etc/ssh/sshd_config.
describe package('openssh-server') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q openssh-server (RHEL) or dpkg-query -W -f='${Status}\n' openssh-server (Ubuntu). The expected output is a versioned package name / install ok installed. The daemon can then be confirmed with systemctl is-active sshd (or ssh).
Inspect & investigate
rpm -q openssh-server/dpkg-query -W openssh-server, confirms the package is installed.systemctl show sshd, shows the resolved daemon state.journalctl -u ssh(Ubuntu) orjournalctl -u sshd(RHEL), shows connection and authentication events.
Remediation
Pavois's harden plan declares a package resource for openssh-server with action install and applies it with pavois harden apply, which runs dnf install openssh-server (or apt-get install openssh-server) under the hood. Enabling and hardening sshd (key auth, root login policy) are governed by separate SSH controls.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | openssh-server |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing openssh-server enables a network-facing daemon. On most servers this is expected and required for remote administration. Precaution: once installed and started, sshd listens on port 22, ensure the firewall, sshd_config (disable root password login, prefer keys), and fail2ban-style protections are in place so you are not exposing a weakly-configured service. On hosts that must have no remote access, this control may not apply.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| NIST | CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| DISA STIG | UBTU-22-255010, UBTU-24-100800 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.