OL08-00-020250 - OL 8 must implement multifactor authentication for access to interactive accounts - pam_sss.so


Using an authentication device, such as a Common Access Card (CAC) or token that is separate from the information system, ensures that even if the information system is compromised, that compromise will not affect credentials stored on the authentication device.

Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD CAC.

There are various methods of implementing multifactor authentication for OL 8. Some methods include a local system multifactor account mapping or joining the system to a domain and using an idM server or Microsoft Windows Active Directory server. Any of these methods will require that the client operating system handle the multifactor authentication correctly.

Satisfies: SRG-OS-000105-GPOS-00052, SRG-OS-000106-GPOS-00053, SRG-OS-000107-GPOS-00054, SRG-OS-000108-GPOS-00055


Configure OL 8 to use multifactor authentication for local access to accounts.

Add or update the 'pam_cert_auth' setting in the '/etc/sssd/sssd.conf' file to match the following line:

pam_cert_auth = True

Add or update 'pam_sss.so' with 'try_cert_auth' or 'require_cert_auth' in the '/etc/pam.d/system-auth' and '/etc/pam.d/smartcard-auth' files based on the following examples:

/etc/pam.d/smartcard-auth:auth sufficient pam_sss.so try_cert_auth

/etc/pam.d/system-auth:auth [success=done authinfo_unavail=ignore ignore=ignore default=die] pam_sss.so try_cert_auth

The 'sssd' service must be restarted for the changes to take effect. To restart the 'sssd' service, run the following command:

$ sudo systemctl restart sssd.service

See Also


Item Details


References: 800-53|IA-2(1), 800-53|IA-2(2), 800-53|IA-2(3), 800-53|IA-2(4), CAT|II, CCI|CCI-000765, CCI|CCI-000766, CCI|CCI-000767, CCI|CCI-000768, Rule-ID|SV-248702r779672_rule, STIG-ID|OL08-00-020250, Vuln-ID|V-248702

Plugin: Unix

Control ID: ed67b48c4a33afb8e51437a295ed1aeb3e63b284c7d89cbc9b561c95737e6321