Install authselect Package
Ensures the authselect package is installed, providing the supported way to configure system authentication and the PAM stack on RHEL 8.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
authselect lets administrators select system authentication and identity sources from tested, supported profiles instead of hand-editing the PAM stack, where a single mistake can lock everyone out or silently weaken authentication. As the successor to authconfig, it ships vetted profiles and applies them atomically, reducing configuration drift and breakage. CIS 5.3.1.2 requires it as the foundation for the RHEL 8 PAM hardening controls.
What Pavois checks
Pavois asks rpm (via the InSpec package resource) whether authselect is installed. Checking the effective package state confirms the tool that downstream PAM controls rely on is actually present.
describe package('authselect') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q authselect, expected a version string. Confirm a profile is selected with authselect current, which lists the active profile and its enabled features.
Inspect & investigate
rpm -q authselectconfirms installation;authselect currentshows the active profile.- Profile applications are journaled (
journalctl | grep authselect); resulting authentication events appear in/var/log/secure.
Remediation
Pavois's harden plan installs the authselect package (package resource, install action) with pavois harden apply. Installing it makes the tool available; you still need to select and apply a profile (e.g. authselect select sssd) to actually manage the PAM stack.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | authselect |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing the package alone is non-disruptive. The risk lies in applying a profile: switching authselect profiles rewrites the PAM and nsswitch configuration and can lock out users or break custom PAM modules. If the host has manual /etc/pam.d edits, authselect may refuse to apply without --force; review the diff and keep a root console session open before applying.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 5.3.1.2 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.