EL 10 package defaults, measured
Install a package on Rocky Linux 10, start it, and assume it is safe: for these 25 that assumption is wrong. Some answer anyone, some accept credentials that prove little, some reach into networks they should not, and some do not run at all. We found each one while live-testing an Ansible role that fixes it.
- packages
- 25
- from EPEL
- 11
- from AppStream
- 3
- kinds of default
- 6
Live tests run between 2026-09-19 and 2026-10-08. Where no repository is named, the role's own summary does not name one, so neither do we.
How it was measured
Each default was found on the stock package, in a Rocky Linux 10 container with systemd as PID 1, while the role that fixes it was being built. The role then had to pass a live test in the same container: it converges, a second run changes nothing, and functional checks prove the fix. Where the default let something in, the test tries it and must be refused; where the package did not run, or ran and did nothing, the test makes it do its job. The container is destroyed at the end and the run is recorded as a receipt.
Each entry links to that role's page and to its machine-readable receipt. How we verify, in full: /verified.
Open to anyone who asks
No credential needed at all.
OpenLDAP
EPELAny client, including one that never binds, can read every user's password hash.
The role that fixes it →Receipt (JSON)Live-tested 2026-10-08
net-snmp (snmpd)
AppStreamThe agent answers the community string "public" on every network address.
The role that fixes it →Receipt (JSON)Live-tested 2026-10-08
Mosquitto (MQTT)
It starts in local-only mode, where any client may connect without credentials; packets have no size limit and nothing is kept across a restart.
The role that fixes it →Receipt (JSON)Live-tested 2026-09-19
Authentication that proves little
A credential is asked for, but it does not establish much.
monit
EPELIts web interface on 127.0.0.1:2812 accepts the user admin with the password monit.
The role that fixes it →Receipt (JSON)Live-tested 2026-10-08
NRPE (Nagios agent)
EPELTraffic is encrypted with anonymous Diffie-Hellman, so neither the agent nor the Nagios server proves its identity.
The role that fixes it →Receipt (JSON)Live-tested 2026-10-08
PgBouncer
EPELClient authentication defaults to md5, not SCRAM.
The role that fixes it →Receipt (JSON)Live-tested 2026-10-02
Grafana
Every install that never sets its own secret key uses the same one, and that key encrypts the data-source credentials in its database.
The role that fixes it →Receipt (JSON)Live-tested 2026-09-19
Reaching further than you meant
A legitimate user gets somewhere they should not.
coturn (TURN)
EPELAny valid TURN credential can relay traffic to private 10.x and 192.168.x addresses the server can reach.
The role that fixes it →Receipt (JSON)Live-tested 2026-10-08
Squid
The shipped rules allow localhost before they deny loopback destinations, so any local client can use the proxy to reach services bound to loopback.
The role that fixes it →Receipt (JSON)Live-tested 2026-10-02
Dante (SOCKS5)
EPELA SOCKS user is an ordinary system account, so its password also opens SSH tunnels.
The role that fixes it →Receipt (JSON)Live-tested 2026-10-08
Listening wider, guarding less
Bound to every address, or with nothing set that limits damage.
MariaDB
The server listens on every network address.
The role that fixes it →Receipt (JSON)Live-tested 2026-09-19
Valkey (the Redis successor)
No password, no memory limit and no append-only log.
The role that fixes it →Receipt (JSON)Live-tested 2026-09-19
Caddy
It serves plain HTTP with a Server header, and its admin API is open to any local process.
The role that fixes it →Receipt (JSON)Live-tested 2026-09-19
Broken as installed
The package as shipped does not run until something is fixed.
Knot DNS
EPELThe service cannot start as installed.
The role that fixes it →Receipt (JSON)Live-tested 2026-10-08
OpenDKIM
EPELThe service never starts as installed.
The role that fixes it →Receipt (JSON)Live-tested 2026-10-08
dnsdist
EPELIts own systemd unit cannot read the configuration file the package installs.
The role that fixes it →Receipt (JSON)Live-tested 2026-10-03
NSD
EPELThe package leaves its state directory unwritable.
The role that fixes it →Receipt (JSON)Live-tested 2026-10-03
FreeRADIUS
AppStreamIt ships no CA and no EAP certificate, so it does not start until you make them.
The role that fixes it →Receipt (JSON)Live-tested 2026-10-08
Installed, and quietly doing nothing
It looks like protection. As shipped, it does not act.
dnf-automatic
It is configured to download updates and install none, and no timer is enabled to run it.
The role that fixes it →Receipt (JSON)Live-tested 2026-09-19
AIDE
AppStreamNo unit or timer ships with it, so nothing runs an integrity check on a schedule.
The role that fixes it →Receipt (JSON)Live-tested 2026-09-26
Lynis
EPELIts systemd units sit in the documentation directory, so no audit is ever scheduled.
The role that fixes it →Receipt (JSON)Live-tested 2026-10-02
Login and service resource limits
Nothing limits an account: limits.d is empty, and the ceiling ulimit reports is the one systemd sets.
The role that fixes it →Receipt (JSON)Live-tested 2026-09-27
cron (crond) under systemd
systemd-analyze security scores the scheduler 9.6 UNSAFE, and it holds every capability the kernel has.
The role that fixes it →Receipt (JSON)Live-tested 2026-09-27
What this does not say
- These are behaviours of the packages as installed, on the dates shown. Packages change; a later build may behave differently. The receipts say what ran and when.
- A default is not a vulnerability report. Several are reasonable for a first local start, and upstream may consider them a documented choice. They are listed because a host that keeps them is exposed.
- The list holds what our roles touched. It is not a survey of every package in EL 10.
Cite this page
IaC Bazaar. "EL 10 package defaults, measured." Last checked 2026-10-31.
https://iac-bazaar.ae/research/el-10-package-defaultsEach entry has its own anchor, for example /research/el-10-package-defaults#openldap.