Enable the pcscd Service
Ensures the pcscd.service (PC/SC smart card daemon) is enabled at boot and running, so smart-card and hardware-token authentication works.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Why this rule matters
The PC/SC Smart Card Daemon (pcscd) is the middleware that lets the system talk to smart-card readers and hardware tokens (CAC/PIV, YubiKey PIV, etc.). When this daemon is stopped or disabled, multifactor authentication backed by a physical device silently fails, the reader is invisible to PAM/sssd, so logins fall back to password-only or break entirely. Keeping it enabled is a prerequisite for hardware-backed MFA, which keeps credentials off the host: even a fully compromised system cannot extract the private key held on the card.
What Pavois checks
Pavois reads the effective state of pcscd.service from systemd via service('pcscd.service'), asserting both enabled (will start at boot) and running (active now). Unlike checking that the pcsc-lite package is installed, this catches a daemon that is installed but masked, crashed, or socket-activated-but-never-triggered, the exact failure modes that silently break smart-card login.
only_if { command('authselect current 2>/dev/null | grep -q with-smartcard').exit_status == 0 }
describe service('pcscd.service') do
it { should be_enabled }
it { should be_running }
endHow to verify it is applied
Run systemctl is-enabled pcscd.service and systemctl is-active pcscd.service; expect enabled and active. Confirm a reader is detected with pcsc_scan or opensc-tool --list-readers.
Inspect & investigate
Check journalctl -u pcscd.service for daemon start and reader hot-plug events. systemctl show pcscd.service -p ActiveState -p UnitFileState exposes the state Pavois asserts. PAM/login failures tied to smart cards surface in /var/log/secure (RHEL).
Remediation
Pavois's harden plan acts on the service resource named pcscd with actions enable then start: it sets the unit to start at boot and starts it immediately. Applied with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | # pcscd is the smartcard daemon: it is only relevant with a reader and smartcard auth. # authselect select sssd with-smartcard then: systemctl enable --now pcscd |
|---|---|
| reason | the smartcard stack needs hardware and an auth profile: starting the daemon alone proves nothing |
| resource | manual |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Enabling pcscd is low-risk: it only activates middleware and does not, by itself, enforce smart-card login. The real risk is the opposite, if this rule is part of a policy that also requires smart cards for SSH/console login, ensure a working reader and enrolled card are present before mandating it, or you can lock administrators out. Before applying in an MFA-enforced setup: verify a fallback access path (console, break-glass account) exists. On a host with no smart-card readers and no plan to use them, this control may simply be left as a non-applicable advisory.