Install the pcsc-lite package
Ensures the pcsc-lite package is installed so the host can use smartcard readers for multifactor authentication.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
The pcsc-lite package provides the PC/SC middleware (the pcscd daemon) that lets the system communicate with smartcard readers. It must be installed for smartcard-based multifactor authentication (e.g. PIV/CAC cards) to be available. Without it, the host cannot read hardware tokens, so strong, phishing-resistant authentication for privileged access is impossible.
What Pavois checks
Pavois checks the effective package state with package('pcsc-lite') (resolved through rpm), rather than inferring readiness from config files. Smartcard auth depends on the pcscd middleware actually being present; Pavois confirms the package exists instead of assuming a PAM or SSSD setting implies it.
describe package('pcsc-lite') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q pcsc-lite. Expected output is a versioned package name such as pcsc-lite-1.9.x-.... You can confirm the daemon with systemctl status pcscd.
Inspect & investigate
Installation history is visible with dnf history and in /var/log/dnf.log. Smartcard reader and pcscd activity is logged via journalctl -u pcscd.
Remediation
Pavois's harden plan installs the pcsc-lite package via the package resource (action: install). It is applied with pavois harden apply. Enabling and starting pcscd, and wiring smartcard authentication into PAM/SSSD, remain separate configuration steps.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | pcsc-lite |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing the package is low-risk and does not alter authentication on its own. The risk comes later, when smartcard auth is made required: if pcscd is not running, a reader is missing, or a certificate is invalid, users relying on smartcards can be locked out. - Keep a working fallback (local privileged account or password method) until smartcard login is proven. - Verify pcscd is active and a card is read (pcsc_scan) before enforcing card-only authentication.