← All rules
SOCLE-CLD-PKG-066// Packagesmediuminventory state

Install the opensc Package For Multifactor Authentication

Ensures the opensc package (smart-card / PKCS#11 drivers for multifactor authentication) is installed.

Checked against what is installed or registered, packages present/absent, account databases.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →
FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0Ubuntu 22.04CIS 3.0.0Ubuntu 24.04CIS 1.0.0Ubuntu 26.04
One check, maps to 2 standards

A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.

Why this rule matters

opensc provides the PKCS#11 drivers needed to use smart cards and hardware tokens (such as a CAC or PIV card) for multifactor authentication. Using an authentication device separate from the information system ensures that, even if the system is compromised, the credentials stored on the device are not. Hardware tokens that provide time-based or challenge-response authenticators dramatically raise the bar against credential theft and replay.

What Pavois checks

Pavois asks the package manager whether opensc is installed via the InSpec package resource (rpm -q opensc on RHEL, dpkg-query -W opensc on Ubuntu). Querying installed-package state directly confirms the PKCS#11 middleware is present, rather than inferring smart-card readiness from PAM or pcscd config files.

describe package('opensc') do
  it { should be_installed }
end

How to verify it is applied

Run rpm -q opensc (RHEL) or dpkg-query -W -f='${Status}\n' opensc (Ubuntu). The expected output is a versioned package name / install ok installed. The driver can be confirmed with opensc-tool --list-readers.

Inspect & investigate

  • rpm -q opensc / dpkg-query -W opensc, confirms the package is installed.
  • opensc-tool --list-readers, lists connected smart-card readers.
  • journalctl -u pcscd, shows the smart-card daemon activity when a card is used.

Remediation

Pavois's harden plan declares a package resource for opensc with action install and applies it with pavois harden apply, which runs dnf install opensc (or apt-get install opensc) under the hood. Enabling smart-card login (PAM, pcscd) remains a separate configuration step.

Pavois applies this with its own harden engine, the plan below, not a shell script:

actioninstall
nameopensc
resourcepackage
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

Installing the package alone is non-disruptive, it adds drivers without changing authentication behavior. The risk appears only when you later enforce smart-card login in PAM/SSSD: a misconfiguration or a card-reader failure can lock out users. Precaution: keep a fallback local admin account, test card-based login interactively before making it mandatory, and ensure pcscd is running.

Standards mapping

StandardReferenceTypeVersionConfidence
NISTCM-6(a)supporting800-53 Rev 5 · 800-171 Rev 2 (pinned)medium
DISA STIGUBTU-22-612015, UBTU-24-100900directper OS STIG releasehigh

Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.

Sources & references