Install rear Package
Ensures the rear (Relax-and-Recover) disaster-recovery package is installed.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
rear provides the Relax-and-Recover (ReaR) utility, which produces a bootable rescue image of the system and can restore it from backup using that image. A tested bare-metal/disaster-recovery capability is part of resilience and availability requirements: without it, recovering a failed or compromised host after a ransomware event or hardware loss is slow and error-prone. Installing ReaR makes the recovery tooling available so backups can be turned into a restorable system.
What Pavois checks
Pavois checks the effective package state with package('rear') (resolved through rpm). The presence of a /etc/rear/local.conf does not prove the tool is installed; Pavois confirms the rear binary's package is actually present rather than inferring recovery readiness from a config file.
describe package('rear') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q rear. Expected output is a versioned package name such as rear-2.x-.... You can confirm the tool runs with rear --version.
Inspect & investigate
Installation history is visible with dnf history and in /var/log/dnf.log. ReaR backup/recovery runs log to /var/log/rear/ (e.g. rear-<hostname>.log).
Remediation
Pavois's harden plan installs the rear package via the package resource (action: install). It is applied with pavois harden apply. Installing the package does not create a recovery image, you must still configure /etc/rear/local.conf (backup method, output target) and run rear mkbackup to produce a usable rescue medium.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | rear |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing rear is low-risk; it adds tooling and does not alter running services. The real consideration is operational: an unconfigured or untested ReaR gives a false sense of recoverability. - After install, configure and test a real recovery (rear mkbackup then a restore drill on spare hardware/VM). - ReaR images can contain sensitive data, store the output target securely and restrict its permissions.