Install nss-sss Package
Ensures the libnss-sss NSS module (required by SSSD) is installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
libnss-sss provides the NSS (Name Service Switch) module required by SSSD (System Security Services Daemon). Without it, the sss entries in /etc/nsswitch.conf cannot resolve and the system cannot use SSSD for centralized identity, authentication and access control. SSSD is the modern, secure replacement for legacy mechanisms like NIS and direct nss_ldap, providing offline caching, Kerberos integration and encrypted transport.
What Pavois checks
Pavois asks the package manager whether libnss-sss is installed via the InSpec package resource (effectively dpkg-query -W libnss-sss). Checking the installed-package state directly confirms the NSS module is actually present, rather than inferring it from nsswitch.conf lines that may reference sss without the backing library being installed.
describe package('libnss-sss') do
it { should be_installed }
endHow to verify it is applied
Run dpkg-query -W -f='${Status}\n' libnss-sss. The expected output contains install ok installed. You can also confirm the module is wired in with grep sss /etc/nsswitch.conf.
Inspect & investigate
dpkg-query -W libnss-sss, confirms the package is present.journalctl -u sssd, shows SSSD activity once configured.getent passwd <user>, resolves a centrally-managed user through thesssNSS source when working.
Remediation
Pavois's harden plan declares a package resource for nss-sss with action install and applies it with pavois harden apply, which runs apt-get install libnss-sss under the hood. Configuring SSSD itself (domains, nsswitch.conf) remains a separate step.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | libnss-sss |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing the package alone is non-disruptive, it only adds a library. The risk lies in configuring SSSD: a broken sssd.conf or nsswitch.conf referencing sss without a reachable identity backend can break user lookups and lock out remote logins. Precaution: keep a local sudo/root account, configure and test SSSD before pointing nsswitch.conf at sss, and validate with getent passwd <user> before relying on it.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| DISA STIG | UBTU-22-254010, UBTU-24-100650 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.