content_rule_sssd_enable_smartcards rule is not passing after remediation

[marcusburghardt]

Description of problem:

The content_rule_sssd_enable_smartcards rule is not passing after Ansible remediation.

SCAP Security Guide Version:

Master

Operating System Version:

RHEL8

Actual Results:

xccdf_org.ssgproject.content_rule_sssd_enable_smartcards - fail

Expected Results:

xccdf_org.ssgproject.content_rule_sssd_enable_smartcards - pass

Additional Information/Debugging Steps:

Profiles:

• STIG Server
• STIG Server With GUI

[hjones2199]

Getting the same issue on Fedora 36 with xccdf_org.ssgproject.content_benchmark_FEDORA profile. Looks to me that the scanner is checking for pam_cert_auth = true (note the lowercase true), whereas according to the sssd.conf manpage, it should be pam_cert_auth = True

[marcusburghardt]

There are more issues with the sssd_enable_smartcards rule. The current remediation is creating a custom authselect profile and updating the files. However, there is already an authselect feature out-of-box to enable smartcard authentication. Therefore, a custom profile is not necessary. I already have a WIP PR to fix this using the new PAM macros proposed by the #9017 PR. I would prefer to wait the #9017 PR in order to avoid rework on this rule.

The #8930 is also welcome to improve this rule in parallel.

[yuumasato]

There are more issues with the sssd_enable_smartcards rule. The current remediation is creating a custom authselect profile and updating the files. However, there is already an authselect feature out-of-box to enable smartcard authentication.

This custom profile is breaking sudo, using the with-smartcard feature from authselect solved the issue for me.