
Got STIGs? I know what you don't got in RHEL 10!
I'm already on a tirade over the STIG summary posts, so I might as well get it all out before someone sends me packing. :)
I finished working on my Ansible playbooks for remediating RHEL 10 now that we have a STIG, and when I got around to updating our "PKI and Active Directory" join stuff I stumbled upon something nasty.
RHEL 10 (and 9 as of 9.7?) have dropped the pam-ssh-agent package. It turns out that this change proposal for Fedora 42 passed back in 2024. I didn't join as a contributor until April 2024, but I am still sorry for having missed this critical event. I would have said something and engaged my account executive at the time. (Or maybe even have learned to package the thing myself and just kept it alive.)
The non-STIG afflicted folks out there are probably wondering what the big idea is. The pam-ssh-agent package was how we passed in our smart cards into a RHEL system over SSH, thus allowing us to do things like sudo without a password but still rely on our happy little two-factor proof of identity.
You might say "well, what about nopasswd?" There's a STIG prohibiting that.
"Ok, what about slinging around kerberos tokens since you're using AD anyhow?" Yeah, there's a STIG for that as well. Bonus, it also doesn't work reliably when your AD is STIG compliant as well. (They don't think about or test these things.)
"Ok, ok, ok. Just put in your password already!"
What password? We don't do that around here.
Now, if I find some other way that works, I'll let you guys know. It may very well come down to us documenting, compiling, packaging, and signing something in-house. It just never occurred to me that Red Hat would yank something that provides a critical feature and not provide a replacement. Even the RHEL 10 documentation on the topic is... Well, I think an AI wrote it, to be honest.
Oh, well. :)