mediumaccess-controlverified ✓rollback-safe

Install the packages required for multifactor authentication

sssd-mfa-packages-installed · UBUNTU ≥ 22 · 1 impl

Description

The packages that provide SSSD-based multifactor and smart-card authentication (in particular the PAM SSS module, libpam-sss) must be installed so that PIV/CAC and other multifactor methods can be enforced through PAM and NSS.

Rationale

Multifactor authentication cannot be enforced without the software that integrates smart-card / SSSD credentials into the authentication stack. If the required packages are absent, the system falls back to single-factor password authentication, weakening access control for privileged and remote logons.

Check → Remediate

Checkcommand

dpkg -l 2>/dev/null | grep -qE '^ii[[:space:]]+libpam-sss([[:space:]]|:)'

expected_exit:: 0

Remediateapt_present

name:: libpam-sss

Framework references

STIG

V-270662 / UBTU-24-100650

NIST 800-53

IA-2(1)IA-2(2)IA-8

Live verification

ubuntu24:check

#sssd#mfa#smart-card#pam#stig