Remove the Kerberos Server Package

An XCCDF Rule

Description

The krb5-server package should be removed if not in use. Is this system the Kerberos server? If not, remove the package. The krb5-server package can be removed with the following command:

$ sudo yum erase krb5-server

The krb5-server RPM is not installed by default on a Red Hat Enterprise Linux 8 system. It is needed only by the Kerberos servers, not by the clients which use Kerberos for authentication. If the system is not intended for use as a Kerberos Server it should be removed.

Rationale

Unnecessary packages should not be installed to decrease the attack surface of the system. While this software is clearly essential on an KDC server, it is not necessary on typical desktop or workstation systems.

ID: xccdf_org.ssgproject.content_rule_package_krb5-server_removed
Severity: Medium
References: CCI-000803

IA-7 IA-7.1

SRG-OS-000120-GPOS-00061

RHEL-08-010163

CCE-85887-8

SV-237640r1017323_rule
Updated: over 1 year ago

include remove_krb5-server

class remove_krb5-server {
  package { 'krb5-server':
    ensure => 'purged',
  }}

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-85887-8
  - DISA-STIG-RHEL-08-010163  - NIST-800-53-IA-7
  - NIST-800-53-IA-7.1
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_krb5-server_removed

- name: Ensure krb5-server is removed
  package:
    name: krb5-server
    state: absent
  when: '"kernel" in ansible_facts.packages'
  tags:
  - CCE-85887-8
  - DISA-STIG-RHEL-08-010163
  - NIST-800-53-IA-7
  - NIST-800-53-IA-7.1
  - disable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - package_krb5-server_removed


package remove krb5-server


dnf remove krb5-server

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

# CAUTION: This remediation script will remove krb5-server
#	   from the system, and may remove any packages
#	   that depend on krb5-server. Execute this#	   remediation AFTER testing on a non-production
#	   system!

if rpm -q --quiet "krb5-server" ; then
yum remove -y "krb5-server"
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi


package --remove=krb5-server

Remove the Kerberos Server Package

Description

Rationale

Remediation - Puppet

Remediation - Ansible

Remediation - script:kickstart

Remediation - script:bootc

Remediation - Shell Script

Remediation - Anaconda Pre-Install Instructions