Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Change authselect base profile for custom profiles #12952

Closed
wants to merge 1 commit into from
Closed

Change authselect base profile for custom profiles #12952

wants to merge 1 commit into from

Conversation

marcusburghardt
Copy link
Member

Description:

In more recent versions of authselect the local profile was introduced to replace the minimal profile and it is the default authselect profile for some products.
However the local profile does not include all features required by Benchmarks.
This PR ensures the sssd profile is used as reference to create custom profiles only in cases local profile is currently selected.

Rationale:

Review Hints:

Automatus can be used to tests the sssd_enable_smartcards rule in a RHEL 10 before and after this PR.

@marcusburghardt
Change authselect base profile for custom profiles
60f78f6 
In more recent versions of authselect the local profile was introduced
to replace the minimal profile and it is the default authselect profile
for some products. However the local profile does not include all
features required by Benchmarks. This commit ensures the sssd profile
is used as reference to create custom profiles only in cases local
profile is currently selected.

Signed-off-by: Marcus Burghardt <maburgha@redhat.com>
@marcusburghardt marcusburghardt added the bugfix Fixes to reported bugs. label Jan 31, 2025
@marcusburghardt marcusburghardt mentioned this pull request Jan 31, 2025
Closed
@github-actions GitHub Actions
Copy link

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff 
bash remediation for rule 'xccdf_org.ssgproject.content_rule_display_login_attempts' differs.
--- xccdf_org.ssgproject.content_rule_display_login_attempts
+++ xccdf_org.ssgproject.content_rule_display_login_attempts
@@ -29,6 +29,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             
@@ -61,6 +66,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     
@@ -121,6 +131,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     
@@ -167,6 +182,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     
@@ -227,6 +247,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_display_login_attempts' differs.
--- xccdf_org.ssgproject.content_rule_display_login_attempts
+++ xccdf_org.ssgproject.content_rule_display_login_attempts
@@ -237,7 +237,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Ensure PAM Displays Last Logon/Access Notification - Create an authselect
+        custom profile based on sssd profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Ensure PAM Displays Last Logon/Access Notification - Ensure authselect

bash remediation for rule 'xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit' differs.
--- xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit
+++ xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit
@@ -56,6 +56,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit' differs.
--- xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit
+++ xccdf_org.ssgproject.content_rule_account_passwords_pam_faillock_audit
@@ -272,7 +272,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Account Lockouts Must Be Logged - Create an authselect custom profile
+          based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
@@ -444,7 +453,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Account Lockouts Must Be Logged - Create an authselect custom profile
+          based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
@@ -35,6 +35,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             
@@ -112,6 +117,11 @@
             # If not already in use, a custom profile is created preserving the enabled features.
             if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                 ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                # If currently used, it is replaced by "sssd", which is the best option in this case.
+                if [[ $CURRENT_PROFILE == local ]]; then
+                    CURRENT_PROFILE="sssd"
+                fi
                 authselect create-profile hardening -b $CURRENT_PROFILE
                 CURRENT_PROFILE="custom/hardening"
                 
@@ -156,6 +166,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth
@@ -239,7 +239,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: 'Limit Password Reuse: password-auth - Create an authselect custom profile
+        based on sssd profile'
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'
@@ -511,7 +520,16 @@
               }}
           when:
           - result_authselect_check_cmd is success
-          - authselect_current_profile is not match("custom/")
+          - authselect_current_profile is not match("^(custom/|local)")
+          - not result_authselect_custom_profile_present.stat.exists
+
+        - name: 'Limit Password Reuse: password-auth - Create an authselect custom
+            profile based on sssd profile'
+          ansible.builtin.command:
+            cmd: authselect create-profile hardening -b sssd
+          when:
+          - result_authselect_check_cmd is success
+          - authselect_current_profile is match("local")
           - not result_authselect_custom_profile_present.stat.exists
 
         - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are
@@ -699,7 +717,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: 'Limit Password Reuse: password-auth - Create an authselect custom profile
+        based on sssd profile'
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: 'Limit Password Reuse: password-auth - Ensure authselect changes are applied'

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth
@@ -35,6 +35,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             
@@ -112,6 +117,11 @@
             # If not already in use, a custom profile is created preserving the enabled features.
             if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                 ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                # If currently used, it is replaced by "sssd", which is the best option in this case.
+                if [[ $CURRENT_PROFILE == local ]]; then
+                    CURRENT_PROFILE="sssd"
+                fi
                 authselect create-profile hardening -b $CURRENT_PROFILE
                 CURRENT_PROFILE="custom/hardening"
                 
@@ -156,6 +166,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth
@@ -239,7 +239,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile
+        based on sssd profile'
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'
@@ -511,7 +520,16 @@
               }}
           when:
           - result_authselect_check_cmd is success
-          - authselect_current_profile is not match("custom/")
+          - authselect_current_profile is not match("^(custom/|local)")
+          - not result_authselect_custom_profile_present.stat.exists
+
+        - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile
+            based on sssd profile'
+          ansible.builtin.command:
+            cmd: authselect create-profile hardening -b sssd
+          when:
+          - result_authselect_check_cmd is success
+          - authselect_current_profile is match("local")
           - not result_authselect_custom_profile_present.stat.exists
 
         - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are
@@ -698,7 +716,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: 'Limit Password Reuse: system-auth - Create an authselect custom profile
+        based on sssd profile'
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: 'Limit Password Reuse: system-auth - Ensure authselect changes are applied'

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
@@ -36,6 +36,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             
@@ -113,6 +118,11 @@
             # If not already in use, a custom profile is created preserving the enabled features.
             if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                 ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                # If currently used, it is replaced by "sssd", which is the best option in this case.
+                if [[ $CURRENT_PROFILE == local ]]; then
+                    CURRENT_PROFILE="sssd"
+                fi
                 authselect create-profile hardening -b $CURRENT_PROFILE
                 CURRENT_PROFILE="custom/hardening"
                 
@@ -157,6 +167,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_remember
@@ -227,7 +227,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Limit Password Reuse - Create an authselect custom profile based on sssd
+        profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Limit Password Reuse - Ensure authselect changes are applied
@@ -491,7 +500,16 @@
               }}
           when:
           - result_authselect_check_cmd is success
-          - authselect_current_profile is not match("custom/")
+          - authselect_current_profile is not match("^(custom/|local)")
+          - not result_authselect_custom_profile_present.stat.exists
+
+        - name: Limit Password Reuse - Create an authselect custom profile based on
+            sssd profile
+          ansible.builtin.command:
+            cmd: authselect create-profile hardening -b sssd
+          when:
+          - result_authselect_check_cmd is success
+          - authselect_current_profile is match("local")
           - not result_authselect_custom_profile_present.stat.exists
 
         - name: Limit Password Reuse - Ensure authselect changes are applied
@@ -671,7 +689,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Limit Password Reuse - Create an authselect custom profile based on sssd
+        profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Limit Password Reuse - Ensure authselect changes are applied

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit
@@ -58,6 +58,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_audit
@@ -290,7 +290,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Account Lockouts Must Be Logged - Create an authselect custom profile
+          based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied
@@ -462,7 +471,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Account Lockouts Must Be Logged - Create an authselect custom profile
+          based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Account Lockouts Must Be Logged - Ensure authselect changes are applied

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
@@ -63,6 +63,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny
@@ -346,7 +346,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Lock Accounts After Failed Password Attempts - Create an authselect
+          custom profile based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes
@@ -523,7 +532,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Lock Accounts After Failed Password Attempts - Create an authselect
+          custom profile based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Lock Accounts After Failed Password Attempts - Ensure authselect changes

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root
@@ -58,6 +58,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny_root
@@ -318,7 +318,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Configure the root Account for Failed Password Attempts - Create an
+          authselect custom profile based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Configure the root Account for Failed Password Attempts - Ensure authselect
@@ -495,7 +504,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Configure the root Account for Failed Password Attempts - Create an
+          authselect custom profile based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Configure the root Account for Failed Password Attempts - Ensure authselect

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
@@ -63,6 +63,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_dir
@@ -316,7 +316,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Lock Accounts Must Persist - Create an authselect custom profile based
+          on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Lock Accounts Must Persist - Ensure authselect changes are applied
@@ -485,7 +494,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Lock Accounts Must Persist - Create an authselect custom profile based
+          on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Lock Accounts Must Persist - Ensure authselect changes are applied

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local
@@ -58,6 +58,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_enforce_local
@@ -299,7 +299,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Enforce pam_faillock for Local Accounts Only - Create an authselect
+          custom profile based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Enforce pam_faillock for Local Accounts Only - Ensure authselect changes
@@ -476,7 +485,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Enforce pam_faillock for Local Accounts Only - Create an authselect
+          custom profile based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Enforce pam_faillock for Local Accounts Only - Ensure authselect changes

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval
@@ -63,6 +63,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval
@@ -323,7 +323,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Set Interval For Counting Failed Password Attempts - Create an authselect
+          custom profile based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Set Interval For Counting Failed Password Attempts - Ensure authselect
@@ -500,7 +509,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Set Interval For Counting Failed Password Attempts - Create an authselect
+          custom profile based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Set Interval For Counting Failed Password Attempts - Ensure authselect

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time
@@ -63,6 +63,11 @@
                 # If not already in use, a custom profile is created preserving the enabled features.
                 if [[ ! $CURRENT_PROFILE == custom/* ]]; then
                     ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+                    # The "local" profile does not contain essential security features required by multiple Benchmarks.
+                    # If currently used, it is replaced by "sssd", which is the best option in this case.
+                    if [[ $CURRENT_PROFILE == local ]]; then
+                        CURRENT_PROFILE="sssd"
+                    fi
                     authselect create-profile hardening -b $CURRENT_PROFILE
                     CURRENT_PROFILE="custom/hardening"
                     

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time' differs.
--- xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time
+++ xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time
@@ -352,7 +352,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Set Lockout Time for Failed Password Attempts - Create an authselect
+          custom profile based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes
@@ -529,7 +538,16 @@
             }}
         when:
         - result_authselect_check_cmd is success
-        - authselect_current_profile is not match("custom/")
+        - authselect_current_profile is not match("^(custom/|local)")
+        - not result_authselect_custom_profile_present.stat.exists
+
+      - name: Set Lockout Time for Failed Password Attempts - Create an authselect
+          custom profile based on sssd profile
+        ansible.builtin.command:
+          cmd: authselect create-profile hardening -b sssd
+        when:
+        - result_authselect_check_cmd is success
+        - authselect_current_profile is match("local")
         - not result_authselect_custom_profile_present.stat.exists
 
       - name: Set Lockout Time for Failed Password Attempts - Ensure authselect changes

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth
@@ -18,6 +18,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_password_auth
@@ -123,7 +123,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Ensure PAM password complexity module is enabled in password-auth - Create
+        an authselect custom profile based on sssd profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Ensure PAM password complexity module is enabled in password-auth - Ensure

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth
@@ -18,6 +18,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_pwquality_system_auth
@@ -123,7 +123,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Ensure PAM password complexity module is enabled in system-auth - Create
+        an authselect custom profile based on sssd profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Ensure PAM password complexity module is enabled in system-auth - Ensure

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_retry' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_retry
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_retry
@@ -43,6 +43,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             
@@ -88,6 +93,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_retry' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_retry
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_retry
@@ -163,7 +163,17 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
+        Permitted Per-Session - Create an authselect custom profile based on sssd
+        profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
@@ -377,7 +387,17 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts
+        Permitted Per-Session - Create an authselect custom profile based on sssd
+        profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Ensure PAM Enforces Password Requirements - Authentication Retry Prompts

bash remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth
@@ -22,6 +22,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             
@@ -84,6 +89,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth
@@ -140,7 +140,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Set PAM's Password Hashing Algorithm - password-auth - Create an authselect
+        custom profile based on sssd profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure authselect
@@ -430,7 +439,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Set PAM's Password Hashing Algorithm - password-auth - Create an authselect
+        custom profile based on sssd profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Set PAM's Password Hashing Algorithm - password-auth - Ensure authselect

bash remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth
@@ -24,6 +24,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             
@@ -86,6 +91,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth' differs.
--- xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth
+++ xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth
@@ -143,7 +143,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Set PAM's Password Hashing Algorithm - Create an authselect custom profile
+        based on sssd profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Set PAM's Password Hashing Algorithm - Ensure authselect changes are applied
@@ -432,7 +441,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Set PAM's Password Hashing Algorithm - Create an authselect custom profile
+        based on sssd profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Set PAM's Password Hashing Algorithm - Ensure authselect changes are applied

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
@@ -22,6 +22,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_password_auth
@@ -126,7 +126,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Set number of Password Hashing Rounds - password-auth - Create an authselect
+        custom profile based on sssd profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Set number of Password Hashing Rounds - password-auth - Ensure authselect

bash remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth
@@ -21,6 +21,11 @@
         # If not already in use, a custom profile is created preserving the enabled features.
         if [[ ! $CURRENT_PROFILE == custom/* ]]; then
             ENABLED_FEATURES=$(authselect current | tail -n+3 | awk '{ print $2 }')
+            # The "local" profile does not contain essential security features required by multiple Benchmarks.
+            # If currently used, it is replaced by "sssd", which is the best option in this case.
+            if [[ $CURRENT_PROFILE == local ]]; then
+                CURRENT_PROFILE="sssd"
+            fi
             authselect create-profile hardening -b $CURRENT_PROFILE
             CURRENT_PROFILE="custom/hardening"
             

ansible remediation for rule 'xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth' differs.
--- xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth
+++ xccdf_org.ssgproject.content_rule_accounts_password_pam_unix_rounds_system_auth
@@ -126,7 +126,16 @@
           }}
       when:
       - result_authselect_check_cmd is success
-      - authselect_current_profile is not match("custom/")
+      - authselect_current_profile is not match("^(custom/|local)")
+      - not result_authselect_custom_profile_present.stat.exists
+
+    - name: Set number of Password Hashing Rounds - system-auth - Create an authselect
+        custom profile based on sssd profile
+      ansible.builtin.command:
+        cmd: authselect create-profile hardening -b sssd
+      when:
+      - result_authselect_check_cmd is success
+      - authselect_current_profile is match("local")
       - not result_authselect_custom_profile_present.stat.exists
 
     - name: Set number of Password Hashing Rounds - system-auth - Ensure authselect

@github-actions GitHub Actions
Copy link

Change in Ansible shell module found.

Please consider using more suitable Ansible module than shell if possible.

@codeclimate CodeClimate
Copy link

codeclimate bot commented Jan 31, 2025

Code Climate has analyzed commit 60f78f6 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 61.9% (0.0% change).

View more on Code Climate.

@Mab879 Mab879 self-assigned this Jan 31, 2025
@Mab879 Mab879 added this to the 0.1.76 milestone Jan 31, 2025
@Mab879
Copy link
Member

Mab879 commented Jan 31, 2025

Superseded by #12955 since I had to rebase this PR.

@Mab879 Mab879 closed this Jan 31, 2025
@marcusburghardt marcusburghardt deleted the authselect_base_for_custom_profile branch February 1, 2025 07:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@Mab879 Mab879

Labels
bugfix Fixes to reported bugs.
Projects
None yet
Milestone
0.1.76
Development

Successfully merging this pull request may close these issues.

Rule sssd_enable_smartcards fails on RHEL 10
2 participants
@marcusburghardt @Mab879