Install the SSSD Package
Ensures the sssd package is installed, providing the daemon needed to integrate the host with centralized identity/authentication providers.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
SSSD (System Security Services Daemon) is the standard framework for integrating a host with centralized identity providers (LDAP, Active Directory, FreeIPA, Kerberos). Central authentication lets you enforce uniform password policy, disable departing users in one place, and cache credentials for offline operation. Without SSSD a system tends to rely on scattered local accounts, which drift, outlive their owners, and weaken accountability, exactly the gaps centralized identity management is meant to close.
What Pavois checks
Pavois reads the effective install state from the package database via CINC/InSpec's package resource and asserts sssd is present. The package must exist before nsswitch.conf/PAM can reference the sss provider, so the package check is the right precondition for any centralized-auth configuration.
describe package('sssd') do
it { should be_installed }
endHow to verify it is applied
Run dpkg -s sssd (Debian/Ubuntu) or rpm -q sssd (RHEL/Alma); a compliant host returns the installed version. When configured, systemctl is-active sssd returns active and sssctl domain-list lists the joined domains.
Inspect & investigate
- Installation is logged in
/var/log/dpkg.logor/var/log/dnf.log. - SSSD's own activity and authentication events go to
/var/log/sssd/andjournalctl -u sssd.
Remediation
The harden plan declares a package resource for sssd with action install; pavois harden apply installs it via the native package manager. Installing the package alone does not join any domain, you still need a valid /etc/sssd/sssd.conf and NSS/PAM wiring for authentication to actually use it.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | sssd |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing the package is safe and changes nothing until configured. The risk is in the configuration step, not the install: a misconfigured sssd.conf or PAM stack can lock out all centrally-managed logins. Before enabling SSSD-backed auth, keep a working local/root session open, test with getent passwd <domain-user>, and ensure local emergency accounts still authenticate. No reboot is required for the package itself.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R67 | direct | 2.0 | high |
| NIST | CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| DISA STIG | UBTU-22-254010, UBTU-24-100650 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.