← All rules
SOCLE-CLD-PKG-079// Packagesmediuminventory state

Install rear Package

Ensures the rear (Relax-and-Recover) disaster-recovery package is installed.

Checked against what is installed or registered, packages present/absent, account databases.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →
FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0

Why this rule matters

rear provides the Relax-and-Recover (ReaR) utility, which produces a bootable rescue image of the system and can restore it from backup using that image. A tested bare-metal/disaster-recovery capability is part of resilience and availability requirements: without it, recovering a failed or compromised host after a ransomware event or hardware loss is slow and error-prone. Installing ReaR makes the recovery tooling available so backups can be turned into a restorable system.

What Pavois checks

Pavois checks the effective package state with package('rear') (resolved through rpm). The presence of a /etc/rear/local.conf does not prove the tool is installed; Pavois confirms the rear binary's package is actually present rather than inferring recovery readiness from a config file.

describe package('rear') do
  it { should be_installed }
end

How to verify it is applied

Run rpm -q rear. Expected output is a versioned package name such as rear-2.x-.... You can confirm the tool runs with rear --version.

Inspect & investigate

Installation history is visible with dnf history and in /var/log/dnf.log. ReaR backup/recovery runs log to /var/log/rear/ (e.g. rear-<hostname>.log).

Remediation

Pavois's harden plan installs the rear package via the package resource (action: install). It is applied with pavois harden apply. Installing the package does not create a recovery image, you must still configure /etc/rear/local.conf (backup method, output target) and run rear mkbackup to produce a usable rescue medium.

Pavois applies this with its own harden engine, the plan below, not a shell script:

actioninstall
namerear
resourcepackage
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

Installing rear is low-risk; it adds tooling and does not alter running services. The real consideration is operational: an unconfigured or untested ReaR gives a false sense of recoverability. - After install, configure and test a real recovery (rear mkbackup then a restore drill on spare hardware/VM). - ReaR images can contain sensitive data, store the output target securely and restrict its permissions.

Sources & references