Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Change authselect base profile for custom profiles and Updates for RHEL 10 #12955

Merged
merged 2 commits into from
Feb 3, 2025
Merged

Change authselect base profile for custom profiles and Updates for RHEL 10 #12955

merged 2 commits into from
Feb 3, 2025

Conversation

Mab879
Copy link
Member

@Mab879 Mab879 commented Jan 31, 2025

Description:

In more recent versions of authselect the local profile was introduced to replace the minimal profile and it is the default authselect profile for some products.
However the local profile does not include all features required by Benchmarks.
This PR ensures the sssd profile is used as reference to create custom profiles only in cases local profile is currently selected.

This PR also adjusts the logic for sssd_enable_smartcards so that it works on RHEL 10.

Rationale:

Review Hints:

  • Automatus can be used to tests the sssd_enable_smartcards rule in a RHEL 10 before and after this PR.
  • Reviewing /etc/pam.d/smartcard-auth with the with-smartcard feature disabled on enabled on RHEL 10 Box with the sssd authselect profile.

marcusburghardt and others added 2 commits January 31, 2025 09:51
@marcusburghardt @Mab879
Change authselect base profile for custom profiles
8e74ac1 
In more recent versions of authselect the local profile was introduced
to replace the minimal profile and it is the default authselect profile
for some products. However the local profile does not include all
features required by Benchmarks. This commit ensures the sssd profile
is used as reference to create custom profiles only in cases local
profile is currently selected.

Signed-off-by: Marcus Burghardt <[email protected]>
@Mab879
Update sssd_enable smartcards
1b16daf 
The OVAL test test_sssd_enable_smartcards_cert_auth_system_auth
don't work in RHEL 10. However, based on testing this not having
this test on RHEL 10 should be fine.
@Mab879 Mab879 added this to the 0.1.76 milestone Jan 31, 2025
@Mab879 Mab879 mentioned this pull request Jan 31, 2025
Closed
@Mab879 Mab879 changed the title Authselect base for custom profile Change authselect base profile for custom profiles and Updates for RHEL 10 Jan 31, 2025
@github-actions GitHub Actions
Copy link

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff 
bash remediation for rule 'xccdf_org.ssgproject.content_rule_display_login_attempts' differs.
--- xccdf_org.ssgproject.content_rule_display_login_attempts
+++ xccdf_org.ssgproject.content_rule_display_login_attempts
@@ -29,6 +29,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             
@@ -61,6 +66,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     
@@ -121,6 +131,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     
@@ -167,6 +182,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     
@@ -227,6 +247,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_display_login_attempts' differs.
--- xccdf_org.ssgproject.content_rule_display_login_attempts
+++ xccdf_org.ssgproject.content_rule_display_login_attempts
@@ -237,7 +237,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Ensure PAM Displays Last Logon/Access Notification - Create an authselect
+        custom profile based on sssd profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Ensure PAM Displays Last Logon/Access Notification - Ensure authselect

bash remediation for rule 'xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit' differs.
--- xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit
+++ xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit
@@ -56,6 +56,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit' differs.
--- xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit
+++ xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit
@@ -272,7 +272,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Account Lockouts Must Be Logged - Create an authselect custom profile
+          based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
@@ -444,7 +453,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Account Lockouts Must Be Logged - Create an authselect custom profile
+          based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
@@ -35,6 +35,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             
@@ -112,6 +117,11 @@
             # If not already in use, a custom profile is created preserving the enabled features.
             if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                 ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                # If currently used, it is replaced by "sssd", which is the best option in this case.
+                if [[ $CURRENT_PROFILE == local ]]; then
+                    CURRENT_PROFILE="sssd"
+                fi
                 authselect create-profile hardening -b $CURRENT_PROFILE
                 CURRENT_PROFILE="custom/hardening"
                 
@@ -156,6 +166,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
@@ -239,7 +239,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: 'Limit Password Reuse: password-auth - Create an authselect custom profile
+        based on sssd profile'
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
@@ -511,7 +520,16 @@
               }}
           when:
           - result_authselect_check_cmd is success
-          - authselect_current_profile is not match("custom/")
+          - authselect_current_profile is not match("^(custom/|local)")
+          - not result_authselect_custom_profile_present.stat.exists
+
+        - name: 'Limit Password Reuse: password-auth - Create an authselect custom
+            profile based on sssd profile'
+          ansible.builtin.command:
+            cmd: authselect create-profile hardening -b sssd
+          when:
+          - result_authselect_check_cmd is success
+          - authselect_current_profile is match("local")
           - not result_authselect_custom_profile_present.stat.exists
 
         - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are
@@ -699,7 +717,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: 'Limit Password Reuse: password-auth - Create an authselect custom profile
+        based on sssd profile'
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth
@@ -35,6 +35,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             
@@ -112,6 +117,11 @@
             # If not already in use, a custom profile is created preserving the enabled features.
             if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                 ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                # If currently used, it is replaced by "sssd", which is the best option in this case.
+                if [[ $CURRENT_PROFILE == local ]]; then
+                    CURRENT_PROFILE="sssd"
+                fi
                 authselect create-profile hardening -b $CURRENT_PROFILE
                 CURRENT_PROFILE="custom/hardening"
                 
@@ -156,6 +166,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth
@@ -239,7 +239,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile
+        based on sssd profile'
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
@@ -511,7 +520,16 @@
               }}
           when:
           - result_authselect_check_cmd is success
-          - authselect_current_profile is not match("custom/")
+          - authselect_current_profile is not match("^(custom/|local)")
+          - not result_authselect_custom_profile_present.stat.exists
+
+        - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile
+            based on sssd profile'
+          ansible.builtin.command:
+            cmd: authselect create-profile hardening -b sssd
+          when:
+          - result_authselect_check_cmd is success
+          - authselect_current_profile is match("local")
           - not result_authselect_custom_profile_present.stat.exists
 
         - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are
@@ -698,7 +716,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile
+        based on sssd profile'
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
@@ -36,6 +36,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             
@@ -113,6 +118,11 @@
             # If not already in use, a custom profile is created preserving the enabled features.
             if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                 ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                # If currently used, it is replaced by "sssd", which is the best option in this case.
+                if [[ $CURRENT_PROFILE == local ]]; then
+                    CURRENT_PROFILE="sssd"
+                fi
                 authselect create-profile hardening -b $CURRENT_PROFILE
                 CURRENT_PROFILE="custom/hardening"
                 
@@ -157,6 +167,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
@@ -227,7 +227,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Limit Password Reuse - Create an authselect custom profile based on sssd
+        profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Limit Password Reuse - Ensure authselect changes are applied
@@ -491,7 +500,16 @@
               }}
           when:
           - result_authselect_check_cmd is success
-          - authselect_current_profile is not match("custom/")
+          - authselect_current_profile is not match("^(custom/|local)")
+          - not result_authselect_custom_profile_present.stat.exists
+
+        - name: Limit Password Reuse - Create an authselect custom profile based on
+            sssd profile
+          ansible.builtin.command:
+            cmd: authselect create-profile hardening -b sssd
+          when:
+          - result_authselect_check_cmd is success
+          - authselect_current_profile is match("local")
           - not result_authselect_custom_profile_present.stat.exists
 
         - name: Limit Password Reuse - Ensure authselect changes are applied
@@ -671,7 +689,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Limit Password Reuse - Create an authselect custom profile based on sssd
+        profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Limit Password Reuse - Ensure authselect changes are applied

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit
@@ -58,6 +58,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit
@@ -290,7 +290,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Account Lockouts Must Be Logged - Create an authselect custom profile
+          based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
@@ -462,7 +471,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Account Lockouts Must Be Logged - Create an authselect custom profile
+          based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
@@ -63,6 +63,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
@@ -346,7 +346,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Lock Accounts After Failed Password Attempts - Create an authselect
+          custom profile based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
@@ -523,7 +532,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Lock Accounts After Failed Password Attempts - Create an authselect
+          custom profile based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root
@@ -58,6 +58,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root
@@ -318,7 +318,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Configure the root Account for Failed Password Attempts - Create an
+          authselect custom profile based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Configure the root Account for Failed Password Attempts - Ensure authselect
@@ -495,7 +504,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Configure the root Account for Failed Password Attempts - Create an
+          authselect custom profile based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Configure the root Account for Failed Password Attempts - Ensure authselect

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
@@ -63,6 +63,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
@@ -316,7 +316,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Lock Accounts Must Persist - Create an authselect custom profile based
+          on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Lock Accounts Must Persist - Ensure authselect changes are applied
@@ -485,7 +494,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Lock Accounts Must Persist - Create an authselect custom profile based
+          on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Lock Accounts Must Persist - Ensure authselect changes are applied

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local
@@ -58,6 +58,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local
@@ -299,7 +299,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Enforce pam_faillock for Local Accounts Only - Create an authselect
+          custom profile based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Enforce pam_faillock for Local Accounts Only - Ensure authselect changes
@@ -476,7 +485,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Enforce pam_faillock for Local Accounts Only - Create an authselect
+          custom profile based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Enforce pam_faillock for Local Accounts Only - Ensure authselect changes

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval
@@ -63,6 +63,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval
@@ -323,7 +323,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Set Interval For Counting Failed Password Attempts - Create an authselect
+          custom profile based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Set Interval For Counting Failed Password Attempts - Ensure authselect
@@ -500,7 +509,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Set Interval For Counting Failed Password Attempts - Create an authselect
+          custom profile based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Set Interval For Counting Failed Password Attempts - Ensure authselect

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time
@@ -63,6 +63,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time
@@ -352,7 +352,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Set Lockout Time for Failed Password Attempts - Create an authselect
+          custom profile based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes
@@ -529,7 +538,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Set Lockout Time for Failed Password Attempts - Create an authselect
+          custom profile based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth
@@ -18,6 +18,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth
@@ -123,7 +123,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Ensure PAM password complexity module is enabled in password-auth - Create
+        an authselect custom profile based on sssd profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Ensure PAM password complexity module is enabled in password-auth - Ensure

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth
@@ -18,6 +18,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth
@@ -123,7 +123,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Ensure PAM password complexity module is enabled in system-auth - Create
+        an authselect custom profile based on sssd profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Ensure PAM password complexity module is enabled in system-auth - Ensure

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_retry' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_retry
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_retry
@@ -43,6 +43,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             
@@ -88,6 +93,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_retry' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_retry
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_retry
@@ -163,7 +163,17 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
+        Permitted Per-Session - Create an authselect custom profile based on sssd
+        profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
@@ -377,7 +387,17 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
+        Permitted Per-Session - Create an authselect custom profile based on sssd
+        profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts

bash remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth
@@ -22,6 +22,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             
@@ -84,6 +89,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth
@@ -140,7 +140,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Set PAM's Password Hashing Algorithm - password-auth - Create an authselect
+        custom profile based on sssd profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure authselect
@@ -430,7 +439,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Set PAM's Password Hashing Algorithm - password-auth - Create an authselect
+        custom profile based on sssd profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure authselect

bash remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth
@@ -24,6 +24,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             
@@ -86,6 +91,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth
@@ -143,7 +143,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Set PAM's Password Hashing Algorithm - Create an authselect custom profile
+        based on sssd profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Set PAM's Password Hashing Algorithm - Ensure authselect changes are applied
@@ -432,7 +441,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Set PAM's Password Hashing Algorithm - Create an authselect custom profile
+        based on sssd profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Set PAM's Password Hashing Algorithm - Ensure authselect changes are applied

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
@@ -22,6 +22,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
@@ -126,7 +126,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Set number of Password Hashing Rounds - password-auth - Create an authselect
+        custom profile based on sssd profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Set number of Password Hashing Rounds - password-auth - Ensure authselect

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth
@@ -21,6 +21,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth
@@ -126,7 +126,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Set number of Password Hashing Rounds - system-auth - Create an authselect
+        custom profile based on sssd profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Set number of Password Hashing Rounds - system-auth - Ensure authselect

@github-actions GitHub Actions
Copy link

Change in Ansible shell module found.

Please consider using more suitable Ansible module than shell if possible.

@codeclimate CodeClimate
Copy link

codeclimate bot commented Jan 31, 2025

Code Climate has analyzed commit 1b16daf and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 61.9% (0.0% change).

View more on Code Climate.

@jan-cerny jan-cerny self-assigned this Feb 3, 2025
jan-cerny
jan-cerny approved these changes Feb 3, 2025
View reviewed changes
Copy link
Collaborator

@jan-cerny jan-cerny left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have run contest test '/hardening/oscap/stig' on a remote VM with the latest RHEL 10 using content from current upstream master. In the generated HTML report the rule sssd_enable_smartcards has failed. Then, I have run the same test using content from this PR branch. There this rule has passed.

@jan-cerny jan-cerny merged commit f9d7eea into ComplianceAsCode:master Feb 3, 2025
103 of 109 checks passed
@Mab879 Mab879 deleted the authselect_base_for_custom_profile branch February 3, 2025 13:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jan-cerny jan-cerny jan-cerny approved these changes

Assignees

@jan-cerny jan-cerny

Labels
None yet
Projects
None yet
Milestone
0.1.76
Development

Successfully merging this pull request may close these issues.

Rule sssd_enable_smartcards fails on RHEL 10
3 participants
@Mab879 @jan-cerny @marcusburghardt