Install the tmux Package
Ensures the tmux package is installed so a terminal session lock can be enforced.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
A session time-out lock protects an unattended terminal when a user steps away without logging out. Rather than relying on users to lock manually, the system should detect an idle session and lock it. The tmux package provides the mechanism to implement and configure such a terminal session lock, so it must be present.
What Pavois checks
Pavois verifies that the tmux package is present in the package database. This is a prerequisite control: the lock policy (idle timeout) depends on the binary existing, so the package query is the authoritative signal that the capability is available.
describe package('tmux') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q tmux and expect a version line such as tmux-<version>.el8 (not package tmux is not installed).
Inspect & investigate
Installation is recorded by the package manager: dnf history or rpm -q --last tmux. Whether the lock is actually wired up is separate (e.g. the /etc/profile.d tmux auto-start and idle-lock settings).
Remediation
Pavois's harden plan declares the tmux package resource with action install, so pavois harden apply installs it via dnf. Note this only provides the tool; configuring the idle session lock is handled by the related lock-policy controls.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | tmux |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing tmux adds a small, well-established package and has no service-breaking effect. Precaution: if a tmux auto-start / idle-lock is later configured globally (e.g. via /etc/profile.d), test it in an interactive shell first, a misconfigured auto-start can interfere with non-interactive logins or automated SSH commands. The install itself is safe.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| NIST | 3.1.10 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.