mediumservicesverified ✓
Ensure the SSSD service is enabled and active
sssd-service-enabled-active · UBUNTU ≥ 22 · 1 impl
Description
The System Security Services Daemon (sssd) must be both enabled (starts on boot) and active (currently running) so it can broker multifactor and smart-card authentication.
Rationale
SSSD integrates smart-card / PKI credentials and centralized identity into the authentication stack. If the sssd service is not enabled and running, multifactor authentication cannot be enforced.
Check → Remediate
Checkcommand
systemctl is-enabled sssd 2>/dev/null | grep -qx enabled || {
echo "FAIL: sssd service is not enabled"; exit 1; }
systemctl is-active sssd 2>/dev/null | grep -qx active || {
echo "FAIL: sssd service is not active"; exit 1; }
echo "OK: sssd service is enabled and active"; exit 0
- expected_exit:
- 0
Remediatemanual
- note:
- Enable and start SSSD: systemctl enable --now sssd.service (SSSD must first be configured for the site's identity/MFA provider).
Framework references
STIG
V-270663 / UBTU-24-100660V-274866 / UBTU-22-254015
NIST 800-53
IA-2(1)IA-2(2)
Live verification
ubuntu22:checkubuntu24:check
#sssd#service#mfa#authentication#stig