← All rules
SOCLE-CLD-PKG-073// Packagesmediuminventory state

Install the pcsc-lite package

Ensures the pcsc-lite package is installed so the host can use smartcard readers for multifactor authentication.

Checked against what is installed or registered, packages present/absent, account databases.

A pass proves✓ running now✓ on disk✓ survives rebootthe qualified verdict →
FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0

Why this rule matters

The pcsc-lite package provides the PC/SC middleware (the pcscd daemon) that lets the system communicate with smartcard readers. It must be installed for smartcard-based multifactor authentication (e.g. PIV/CAC cards) to be available. Without it, the host cannot read hardware tokens, so strong, phishing-resistant authentication for privileged access is impossible.

What Pavois checks

Pavois checks the effective package state with package('pcsc-lite') (resolved through rpm), rather than inferring readiness from config files. Smartcard auth depends on the pcscd middleware actually being present; Pavois confirms the package exists instead of assuming a PAM or SSSD setting implies it.

describe package('pcsc-lite') do
  it { should be_installed }
end

How to verify it is applied

Run rpm -q pcsc-lite. Expected output is a versioned package name such as pcsc-lite-1.9.x-.... You can confirm the daemon with systemctl status pcscd.

Inspect & investigate

Installation history is visible with dnf history and in /var/log/dnf.log. Smartcard reader and pcscd activity is logged via journalctl -u pcscd.

Remediation

Pavois's harden plan installs the pcsc-lite package via the package resource (action: install). It is applied with pavois harden apply. Enabling and starting pcscd, and wiring smartcard authentication into PAM/SSSD, remain separate configuration steps.

Pavois applies this with its own harden engine, the plan below, not a shell script:

actioninstall
namepcsc-lite
resourcepackage
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

Installing the package is low-risk and does not alter authentication on its own. The risk comes later, when smartcard auth is made required: if pcscd is not running, a reader is missing, or a certificate is invalid, users relying on smartcards can be locked out. - Keep a working fallback (local privileged account or password method) until smartcard login is proven. - Verify pcscd is active and a card is read (pcsc_scan) before enforcing card-only authentication.

Sources & references