Detections
Analytics

1.107 UBTU-22-612035

Information

The operating system for PKI-based authentication, must implement a local cache of revocation data in case of the inability to access revocation information via the network.

GROUP ID: V-260578
RULE ID: SV-260578r1015021

Without configuring a local cache of revocation data, there is the potential to allow access to users who are no longer authorized (users with revoked certificates).

Solution

Configure the operating system, for PKI-based authentication, to use local revocation data when unable to access the network to obtain it remotely.

Add or update the "cert_policy" option in "/etc/pam_pkcs11/pam_pkcs11.conf" to include "crl_auto" or "crl_offline".

cert_policy = ca,signature,ocsp_on, crl_auto;

If the system is missing an "/etc/pam_pkcs11/" directory and an "/etc/pam_pkcs11/pam_pkcs11.conf", find an example to copy into place and modify accordingly at "/usr/share/doc/libpam-pkcs11/examples/pam_pkcs11.conf.example.gz".

See Also

https://workbench.cisecurity.org/benchmarks/22168

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(2), CAT|II, CCI|CCI-004068, CSCv7|16.3, Rule-ID|SV-260578r1015021_rule, STIG-ID|UBTU-22-612035, Vuln-ID|V-260578

Plugin: Unix

Control ID: 8299e7cbffc050633147ee4f810d972f9d9fd00183cee178b1e93be0602c628c