Remove the X Windows Package Group
Ensures the core X server package xserver-xorg-core is not installed on headless Debian/Ubuntu hosts.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Unnecessary service packages must not be installed in order to decrease the attack surface of the system. xserver-xorg-core is the core X server package on Debian/Ubuntu; the X Window System has a long history of security vulnerabilities and is not needed on a headless server. Unless graphical login is specifically approved and documented, the X server should not be present.
What Pavois checks
Pavois queries the package database via the InSpec package('xserver-xorg-core') resource (dpkg -s). This is the Debian/Ubuntu equivalent of xorg-x11-server-common on RHEL: it is the core dependency of the graphical stack, so its absence means no X server can run regardless of which desktop metapackages once existed.
describe package('xserver-xorg-core') do
it { should_not be_installed }
endHow to verify it is applied
Run dpkg -s xserver-xorg-core. Expected output: dpkg-query: package 'xserver-xorg-core' is not installed and no information is available.
Inspect & investigate
- Package state:
dpkg -s xserver-xorg-core/apt list --installed | grep xserver-xorg-core; removal recorded in/var/log/dpkg.logand/var/log/apt/history.log. - Default boot target:
systemctl get-default(should bemulti-user.targeton a headless host).
Remediation
Pavois's harden plan declares a package resource for xserver-xorg-core with action remove, so pavois harden apply uninstalls it (apt-get purge xserver-xorg-core). As the core X dependency, removing it pulls the rest of the X graphical stack with it.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | remove |
|---|---|
| name | xserver-xorg-core |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Removing the core X server uninstalls the graphical environment: local desktop sessions, X11 forwarding, and GUI applications stop working. Before applying: confirm the machine is meant to be headless and that no admin relies on a local or X11-forwarded GUI, check systemctl get-default and apt list --installed | grep -E 'gdm|gnome|xfce|kde'. On a server this is the intended hardening; on a workstation it is destructive. No SSH lockout risk (X is independent of SSH login); set the default target to multi-user.target afterward.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.20 | direct | per OS, see the benchmark table | high |
| NIST | CM-6(a), CM-7(a), CM-7(b) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.