Remove the X Windows Package Group
Ensures the X server shared component xorg-x11-server-common is not installed on headless RHEL/Debian-family hosts.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Unnecessary service packages must not be installed in order to decrease the attack surface of the system. The X Window System (xorg-x11-server-common is the shared component of the X server) has a long history of security vulnerabilities and is not needed on a headless server. Unless graphical login is specifically approved and documented, the X server should not be present.
What Pavois checks
Pavois queries the package database via the InSpec package('xorg-x11-server-common') resource (rpm -q / dpkg -s). Targeting the shared X server component is reliable because it is a dependency of the full graphical stack: if it is absent, no X server can start regardless of which desktop metapackages were once installed.
describe package('xserver-xorg-core') do
it { should_not be_installed }
endHow to verify it is applied
On RHEL-family: rpm -q xorg-x11-server-common → package xorg-x11-server-common is not installed. (On Debian/Ubuntu the equivalent core package is xserver-xorg-core, see the related rule.)
Inspect & investigate
- Package state:
rpm -q xorg-x11-server-common/dpkg -s xorg-x11-server-common; removal in/var/log/dnf.rpm.logor/var/log/dpkg.log. - Graphical target state:
systemctl get-default(should bemulti-user.target, notgraphical.target).
Remediation
Pavois's harden plan declares a package resource for xorg-x11-server-common with action remove, so pavois harden apply uninstalls it (dnf remove xorg-x11-server-common). Because it is a base dependency, removing it pulls the rest of the X graphical stack with it.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | xserver-xorg-core |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing the X server component will uninstall the graphical environment: any local desktop session, X11 forwarding, or GUI applications on this host will stop working. Before applying: confirm the machine is meant to be headless and no admin relies on a local/remote GUI, check systemctl get-default and whether users run X11-forwarded apps. On a server this is the desired hardening; on a workstation it is destructive. There is no SSH lockout risk (X is unrelated to SSH login), but switch the default target to multi-user.target to avoid boot delays.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.20 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.