documentation_complete: true


title: 'Enable the SSSD Service'

description: |-
    The SSSD service should be enabled.
    {{{ describe_service_enable(service="sssd") }}}

rationale: ""

severity: medium

identifiers:
    cce@rhel8: CCE-82440-9
    cce@rhel9: CCE-86088-2
    cce@rhel10: CCE-87447-9

platform: system_with_kernel and package[sssd]

references:
    cis-csc: 1,12,15,16,5
    cobit5: DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.03,DSS06.10
    isa-62443-2009: 4.3.3.2.2,4.3.3.5.1,4.3.3.5.2,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.2,4.3.3.7.4
    isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.7,SR 1.8,SR 1.9,SR 2.1'
    iso27001-2013: A.18.1.4,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3
    nist: CM-6(a),IA-5(10)
    nist-csf: PR.AC-1,PR.AC-6,PR.AC-7
    srg: SRG-OS-000375-GPOS-00160

ocil_clause: 'the service is not enabled'

ocil: |-
    {{{ ocil_service_enabled(service="sssd") }}}

template:
    name: service_enabled
    vars:
        servicename: sssd
        packagename: sssd-common

warnings:
    - general:
        The service requires a valid sssd configuration. If the configuration is
        not present, the service will fail to start and consequently this rule
        will be reported as failing. The configuration shipped in your
        distribution package might not be sufficient. Manual modification of
        configuration files might be required.
