Install subscription-manager Package
Ensures the subscription-manager package is installed, so the RHEL host can register and pull entitled security updates.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
Red Hat Subscription Manager is a local service that tracks installed products and subscriptions on the system to manage subscription assignments. It communicates with the backend subscription service (the Customer Portal or an on-premise server such as Satellite/Subscription Asset Manager) and works with content-management tooling. In practice, a registered subscription is what entitles the host to security errata and patches, without it, the system cannot reliably receive updates, which is itself a security exposure.
What Pavois checks
Pavois reads the effective install state from the RPM database via CINC/InSpec's package resource and asserts subscription-manager is present. The package presence is the precondition for subscription-manager register and for the rhsm repositories to function, a config check alone would not reveal whether the tooling actually exists.
describe package('subscription-manager') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q subscription-manager; a compliant host returns the installed version. Registration status can be confirmed with subscription-manager status (expects Overall Status: Current) or subscription-manager identity.
Inspect & investigate
- Installation is logged in
/var/log/dnf.logand visible viarpm -q --last subscription-manager. - Registration and entitlement activity is recorded in
/var/log/rhsm/rhsm.log.
Remediation
The harden plan declares a package resource for subscription-manager with action install; pavois harden apply installs it via dnf. Installing the package does not register the host, you still run subscription-manager register (or attach to Satellite) afterward to actually receive entitlements.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | subscription-manager |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing the package is safe and non-disruptive. The precaution is environment fit: on hosts that deliberately use a different content source (a local mirror, Katello/Foreman, or CentOS Stream/clones like AlmaLicense-managed mirrors), subscription-manager may be irrelevant or could be misconfigured to point at the wrong CDN. Verify your patch-management strategy before registering; the install itself requires no reboot and breaks nothing.