Detections
Analytics

5.3.1.2 Ensure latest version of authselect is installed

Information

Authselect is a utility that simplifies the configuration of user authentication. Authselect offers ready-made profiles that can be universally used with all modern identity management systems.

You can create and deploy a custom profile by customizing one of the default profiles: the sssd, winbind, or the nis profile. This is particularly useful if modifying a ready-made authselect profile is not enough for your needs. When you deploy a custom profile, the profile is applied to every user logging into the given host. This is the recommended method, so that the existing profiles can remain unmodified.

Authselect only modifies files in the following locations:

/etc/nsswitch.conf
/etc/pam.d/*
/etc/dconf/db/distro.d/*

To ensure the system has access to the authselect functionality used by this Benchmark, the installed version of authselect should be 1.2.6-1 or later.

Solution

Run the following command to install or update authselect to the latest version:

# dnf install authselect

Impact:

If local site customizations have been made to an authselect default or custom profile created with the --symlink-pam option, these customizations may be over-written by updating authselect.

WARNING:

Do not use authselect if:

 - your host is part of Linux Identity Management. Joining your host to an IdM domain with the ipa-client-install command automatically configures SSSD authentication on your host.
 - Your host is part of Active Directory via SSSD. Calling the realm join command to join your host to an Active Directory domain automatically configures SSSD authentication on your host.

It is not recommended to change the authselect profiles configured by ipa-client-install or realm join. If you need to modify them, display the current settings before making any modifications, so you can revert back to them if necessary

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-2

Plugin: Unix

Control ID: 2cc4141b5ff48b0c83d04dd27653d4e1145ddce3cdcaa855b49b12776e48dab4