IaC Bazaar
Browse modules
Menu

EL 10 package defaults, measured

Install a package on Rocky Linux 10, start it, and assume it is safe: for these 25 that assumption is wrong. Some answer anyone, some accept credentials that prove little, some reach into networks they should not, and some do not run at all. We found each one while live-testing an Ansible role that fixes it.

packages
25
from EPEL
11
from AppStream
3
kinds of default
6

Live tests run between 2026-09-19 and 2026-10-08. Where no repository is named, the role's own summary does not name one, so neither do we.

How it was measured

Each default was found on the stock package, in a Rocky Linux 10 container with systemd as PID 1, while the role that fixes it was being built. The role then had to pass a live test in the same container: it converges, a second run changes nothing, and functional checks prove the fix. Where the default let something in, the test tries it and must be refused; where the package did not run, or ran and did nothing, the test makes it do its job. The container is destroyed at the end and the run is recorded as a receipt.

Each entry links to that role's page and to its machine-readable receipt. How we verify, in full: /verified.

Open to anyone who asks

No credential needed at all.

Authentication that proves little

A credential is asked for, but it does not establish much.

Reaching further than you meant

A legitimate user gets somewhere they should not.

Listening wider, guarding less

Bound to every address, or with nothing set that limits damage.

Broken as installed

The package as shipped does not run until something is fixed.

Installed, and quietly doing nothing

It looks like protection. As shipped, it does not act.

What this does not say

  • These are behaviours of the packages as installed, on the dates shown. Packages change; a later build may behave differently. The receipts say what ran and when.
  • A default is not a vulnerability report. Several are reasonable for a first local start, and upstream may consider them a documented choice. They are listed because a host that keeps them is exposed.
  • The list holds what our roles touched. It is not a survey of every package in EL 10.

Cite this page

IaC Bazaar. "EL 10 package defaults, measured." Last checked 2026-10-31.
https://www.iac-bazaar.com/research/el-10-package-defaults

Each entry has its own anchor, for example /research/el-10-package-defaults#openldap.