Disable debug-shell SystemD Service
Ensures the systemd debug-shell.service unit is disabled and not running so no passwordless root shell is reachable at boot.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
debug-shell.service opens a root shell with no authentication on tty9, intended for diagnosing boot failures. If it is enabled, anyone with physical or console access (or who can force a reboot) gains an instant root shell, bypassing all login controls. It must stay disabled on any production system.
What Pavois checks
Pavois queries the resolved unit state via systemctl is-enabled / is-active for debug-shell.service. Reading the effective service state catches a unit enabled by a drop-in or a static alias that a file-based scan of /etc/systemd would miss.
describe service('debug-shell.service') do
it { should_not be_enabled }
it { should_not be_running }
endHow to verify it is applied
Run systemctl is-enabled debug-shell.service (expected disabled or masked) and systemctl is-active debug-shell.service (expected inactive).
Inspect & investigate
Inspect systemctl show debug-shell.service for UnitFileState and ActiveState; activation events appear in journalctl -u debug-shell.service.
Remediation
Pavois's harden plan applies a service resource for debug-shell with actions disable and stop, ensuring the unit will not start at boot and is halted now. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | disable, stop |
|---|---|
| name | debug-shell |
| resource | service |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disabling debug-shell.service only removes an emergency diagnostic shell; no production workload depends on it, so impact is minimal. Precaution: if you rely on it to recover unbootable systems, keep an alternative recovery path (rescue target, console access, known root password) before applying.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| NIST | 3.4.5 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.