Install the opensc Package For Multifactor Authentication
Ensures the opensc package (smart-card / PKCS#11 drivers for multifactor authentication) is installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
opensc provides the PKCS#11 drivers needed to use smart cards and hardware tokens (such as a CAC or PIV card) for multifactor authentication. Using an authentication device separate from the information system ensures that, even if the system is compromised, the credentials stored on the device are not. Hardware tokens that provide time-based or challenge-response authenticators dramatically raise the bar against credential theft and replay.
What Pavois checks
Pavois asks the package manager whether opensc is installed via the InSpec package resource (rpm -q opensc on RHEL, dpkg-query -W opensc on Ubuntu). Querying installed-package state directly confirms the PKCS#11 middleware is present, rather than inferring smart-card readiness from PAM or pcscd config files.
describe package('opensc') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q opensc (RHEL) or dpkg-query -W -f='${Status}\n' opensc (Ubuntu). The expected output is a versioned package name / install ok installed. The driver can be confirmed with opensc-tool --list-readers.
Inspect & investigate
rpm -q opensc/dpkg-query -W opensc, confirms the package is installed.opensc-tool --list-readers, lists connected smart-card readers.journalctl -u pcscd, shows the smart-card daemon activity when a card is used.
Remediation
Pavois's harden plan declares a package resource for opensc with action install and applies it with pavois harden apply, which runs dnf install opensc (or apt-get install opensc) under the hood. Enabling smart-card login (PAM, pcscd) remains a separate configuration step.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | opensc |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing the package alone is non-disruptive, it adds drivers without changing authentication behavior. The risk appears only when you later enforce smart-card login in PAM/SSSD: a misconfiguration or a card-reader failure can lock out users. Precaution: keep a fallback local admin account, test card-based login interactively before making it mandatory, and ensure pcscd is running.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| NIST | CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| DISA STIG | UBTU-22-612015, UBTU-24-100900 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.