Enable authselect

문서 > Datadog 보안 > OOTB Rules > Enable authselect

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Description

Configure user authentication setup to use the authselect tool. If authselect profile is selected, the rule will enable the sssd profile.

Rationale

Authselect is a successor to authconfig. It is a tool to select system authentication and identity sources from a list of supported profiles instead of letting the administrator manually build the PAM stack.

That way, it avoids potential breakage of configuration, as it ships several tested profiles that are well tested and supported to solve different use-cases.

Remediation

Shell script

The following script can be run on the host to remediate the issue.

#!/bin/bash

var_authselect_profile='sssd'


authselect select "$var_authselect_profile"

if test "$?" -ne 0; then
    if rpm --quiet --verify pam; then
        authselect select --force "$var_authselect_profile"
    else
	echo "Files in the 'pam' package have been altered, so the authselect configuration won't be forced" >&2
    fi
fi

Ansible playbook

The following playbook can be run with Ansible to remediate the issue.

- name: XCCDF Value var_authselect_profile # promote to variable
  set_fact:
    var_authselect_profile: !!str sssd
  tags:
    - always

- name: Enable authselect - Select authselect profile
  ansible.builtin.command:
    cmd: authselect select "{{ var_authselect_profile }}"
  register: result_authselect_select
  failed_when: false
  tags:
  - CCE-88248-0
  - NIST-800-53-AC-3
  - PCI-DSSv4-8.3.4
  - configure_strategy
  - enable_authselect
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Enable authselect - Verify if PAM has been altered
  ansible.builtin.command:
    cmd: rpm -qV pam
  register: result_altered_authselect
  failed_when: false
  when: result_authselect_select.rc != 0
  tags:
  - CCE-88248-0
  - NIST-800-53-AC-3
  - PCI-DSSv4-8.3.4
  - configure_strategy
  - enable_authselect
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Enable authselect - Informative message based on the authselect integrity
    check
  ansible.builtin.assert:
    that:
    - result_altered_authselect is skipped or result_altered_authselect.rc == 0
    fail_msg:
    - Files in the 'pam' package have been altered, so the authselect configuration
      won't be forced.
  tags:
  - CCE-88248-0
  - NIST-800-53-AC-3
  - PCI-DSSv4-8.3.4
  - configure_strategy
  - enable_authselect
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

- name: Enable authselect - Force authselect profile select
  ansible.builtin.command:
    cmd: authselect select --force "{{ var_authselect_profile }}"
  when:
  - result_authselect_select.rc != 0
  - result_altered_authselect is skipped or result_altered_authselect.rc == 0
  tags:
  - CCE-88248-0
  - NIST-800-53-AC-3
  - PCI-DSSv4-8.3.4
  - configure_strategy
  - enable_authselect
  - low_complexity
  - medium_disruption
  - medium_severity
  - no_reboot_needed

Warning

If the sudo authselect select command returns an error informing that the chosen profile cannot be selected, it is probably because PAM files have already been modified by the administrator. If this is the case, in order to not overwrite the desired changes made by the administrator, the current PAM settings should be investigated before forcing the selection of the chosen authselect profile.