Detections
Analytics

1.67 AZLX-23-001295

Information

Amazon Linux 2023 must map the authenticated identity to the user or group account for PKI-based authentication.

GROUP ID: V-274060RULE ID: SV-274060r1120168

Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis.

Solution

Configure Amazon Linux 2023 to map the authenticated identity to the user or group account by adding or modifying the certmap section of the "/etc/sssd/sssd.conf file based on the following example:

[certmap/testing.test/rule_name]matchrule =<SAN>.*EDIPI@milmaprule = (userCertificate;binary={cert!bin})domains = testing.test

The "sssd" service must be restarted for the changes to take effect. To restart the "sssd" service, run the following command:

$ sudo systemctl restart sssd.service

See Also

https://workbench.cisecurity.org/benchmarks/26107

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(2), CAT|II, CCI|CCI-000187, Rule-ID|SV-274060r1120168_rule, STIG-ID|AZLX-23-001295, Vuln-ID|V-274060

Plugin: Unix

Control ID: 20c2ecf0e3ef3e46bcebe4f102da4205ab61b8b4cac532177d014682cc04fc09