SV-257840r991589: RHEL 9 must have the nss-tools package installed. | Red Hat Enterprise Linux 9 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

RHEL 9 must have the nss-tools package installed.

Description

Discussion Text

Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications. Install the "nss-tools" package to install command-line tools to manipulate the NSS certificate and key database.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366

References

DPMS Target Red Hat Enterprise Linux 9 DISA DPMS Target Red Hat Enterprise Linux 9 5551

Checks

DISA STIG (Manual Reference)

Verify that RHEL 9 has the nss-tools package installed with the following command:

$ dnf list --installed nss-tools

Example output:

nss-tools.x86_64          3.71.0-7.el9

If the "nss-tools" package is not installed, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.rhel9os:def:257840
# RHEL 9 must have the nss-tools package installed.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# package nss-tools is installed
# rpminfo_object (rpminfo_test)
test_1() {
  rpm -q --quiet 'nss-tools' &>/dev/null
}

if test_1; then
  echo "PASS"
else
  echo "FAIL"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.stig.rhel9os:def:257840
if [ -z "$(rpm -qa | grep -w nss-tools)" ]; then echo "FAIL"; exit 1; fi; echo "PASS"; exit 0

Remediation

The nss-tools package can be installed with the following command:
 
$ sudo dnf install nss-tools