Install pam-sss Package
Ensures the libpam-sss package is installed so PAM can authenticate against a centralized identity provider via SSSD.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
The libpam-sss package provides the PAM module for the SSSD (System Security Services Daemon), which integrates the host with centralized identity providers such as LDAP, Active Directory or Kerberos. Without it, PAM cannot authenticate against a domain, and the system is limited to local accounts, blocking centralized policy enforcement (account lockout, password policy, smartcard) and consistent identity management across the fleet.
What Pavois checks
Pavois queries the effective package state with package('libpam-sss') (resolved through dpkg-query), not by guessing from configuration files. A reference to pam_sss.so in a PAM stack is worthless if the module is not actually installed, so Pavois confirms the package is present rather than trusting that a config line implies it.
describe package('libpam-sss') do
it { should be_installed }
endHow to verify it is applied
Run dpkg-query -W -f='${Status}\n' libpam-sss. Expected output: install ok installed. You can also confirm the module file with ls /usr/lib/*/security/pam_sss.so.
Inspect & investigate
Package installation is logged in /var/log/dpkg.log (grep libpam-sss /var/log/dpkg.log). SSSD authentication activity appears in /var/log/auth.log and via journalctl -u sssd.
Remediation
Pavois's harden plan installs the libpam-sss package via the package resource (action: install). It is applied with pavois harden apply. Note that installing the package does not by itself configure SSSD or wire pam_sss.so into the PAM stack, domain enrollment and /etc/sssd/sssd.conf remain a separate step.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | libpam-sss |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing the package alone is low-risk and does not change authentication behavior. The real risk is in the follow-up configuration: a misconfigured PAM stack referencing pam_sss.so while SSSD is down or unreachable can lock out all domain users. - Keep at least one working local privileged account before enabling SSSD in PAM. - Test domain login on a non-production session first. - Verify SSSD is running (systemctl status sssd) and reachable to its provider before making it required in the PAM stack.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| DISA STIG | UBTU-22-254010, UBTU-24-100650 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.