Disable nginx Service
Ensures the nginx.service unit is neither enabled at boot nor running, unless the host is intentionally a web server.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Pavois asserts the effective configuration, the live, resolved state, not a file. File-based scanners (OVAL/SCAP, Lynis) miss Includes, drop-ins and runtime defaults; this check sees what is actually applied.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
An nginx instance listens on the network (typically 80/443) and exposes a parser, TLS stack and any configured virtual hosts to remote attackers. On a machine that is not meant to serve HTTP, a forgotten or default nginx install needlessly widens the attack surface: a single nginx CVE, a misconfigured location block or an exposed status page can become an entry point or an information leak. If the role is not required, the service should be stopped and disabled.
What Pavois checks
Pavois queries the effective service state via service('nginx.service'), which resolves both the enabled (boot-time) and running (current) status from systemd, not from a config file. This matters because a unit can be masked, overridden by a drop-in under /etc/systemd/system/nginx.service.d/, or socket-activated, facts only systemd knows. A file-based scanner that just checks whether the nginx package is installed would miss a service that is installed but actively running, or vice-versa.
describe service('nginx.service') do
it { should_not be_enabled }
it { should_not be_running }
endHow to verify it is applied
Run systemctl is-enabled nginx.service and systemctl is-active nginx.service. Both should report disabled (or masked/not-found) and inactive respectively. A full view: systemctl status nginx.service should show Loaded: ... disabled and Active: inactive (dead).
Inspect & investigate
Inspect journalctl -u nginx.service for start/stop events and any past listener activity. systemctl show nginx.service -p ActiveState -p UnitFileState gives the machine-readable state Pavois relies on. To confirm nothing is still bound to HTTP ports, use ss -tlnp | grep -E ':80|:443'.
Remediation
Pavois's harden plan acts on the service resource named nginx with actions disable then stop: it removes the boot-time enablement and stops the running instance. Applied with pavois harden apply. No file is rewritten, only the systemd unit state changes.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | disable, stop |
|---|---|
| name | nginx |
| resource | service |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
If nginx is legitimately serving traffic (web app, reverse proxy, ACME/Let's Encrypt HTTP-01 challenge), disabling it will take that service offline and may break dependent applications or certificate renewals. Before applying: confirm the host is not meant to serve HTTP (ss -tlnp | grep -E ':80|:443', check for vhosts in /etc/nginx/sites-enabled/), and that no reverse-proxy or load-balancer role depends on it. On a host that genuinely needs nginx, this rule does not apply and should be scoped out.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 2.1.18 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.