Detections
Analytics
RHEL-09-631015 - RHEL 9 must map the authenticated identity to the user or group account for PKI-based authentication.
Information
Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis.Solution
Configure RHEL 9 to map the authenticated identity to the user or group account by adding or modifying the certmap section of the "/etc/sssd/sssd.conf" file based on the following example:[certmap/testing.test/rule_name]
matchrule = .*EDIPI@mil
maprule = (userCertificate;binary={cert!bin})
domains = testing.test
The "sssd" service must be restarted for the changes to take effect. To restart the "sssd" service, run the following command:
$ sudo systemctl restart sssd.service
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RHEL_9_V2R8_STIG.zip
Item Details
Audit Name: DISA Red Hat Enterprise Linux 9 STIG v2r8
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-5(2)(c), CAT|II, CCI|CCI-000187, Rule-ID|SV-258132r1134929_rule, STIG-ID|RHEL-09-631015, Vuln-ID|V-258132
Plugin: Unix
Control ID: 5ea2ef7c4db53e176e349b53d7a87a36c2d8015074e3d78c86adfd7d1b6cd22f