STIGQter: STIG Summary: Canonical Ubuntu 18.04 LTS Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The Ubuntu operating system must implement smart card logins for multifactor authentication for access to accounts.

DISA Rule

SV-219317r610963_rule

Vulnerability Number

V-219317

Group Title

SRG-OS-000105-GPOS-00052

Rule Version

UBTU-18-010427

Severity

CAT II

CCI(s)

• CCI-000765 - The information system implements multifactor authentication for network access to privileged accounts.
• CCI-000766 - The information system implements multifactor authentication for network access to non-privileged accounts.
• CCI-000767 - The information system implements multifactor authentication for local access to privileged accounts.
• CCI-000768 - The information system implements multifactor authentication for local access to non-privileged accounts.
• CCI-001954 - The information system electronically verifies Personal Identity Verification (PIV) credentials.

Weight

10

Fix Recommendation

Configure the Ubuntu operating system to use multifactor authentication for local access to accounts.

Add or update "pam_pkcs11.so" in "/etc/pam.d/common-auth" to match the following line:

auth [success=2 default=ignore] pam_pkcs11.so

Check Contents

Verify the Ubuntu operating system uses multifactor authentication for local access to accounts.

Check that the "pam_pkcs11.so" option is configured in the "/etc/pam.d/common-auth" file with the following command:

# grep pam_pkcs11.so /etc/pam.d/common-auth
auth [success=2 default=ignore] pam_pkcs11.so

If "pam_pkcs11.so" is not set in "/etc/pam.d/common-auth", this is a finding.

Vulnerability Number

V-219317

Documentable

False

Rule Version

UBTU-18-010427

Severity Override Guidance

Verify the Ubuntu operating system uses multifactor authentication for local access to accounts.

Check that the "pam_pkcs11.so" option is configured in the "/etc/pam.d/common-auth" file with the following command:

# grep pam_pkcs11.so /etc/pam.d/common-auth
auth [success=2 default=ignore] pam_pkcs11.so

If "pam_pkcs11.so" is not set in "/etc/pam.d/common-auth", this is a finding.

Check Content Reference

M

Target Key

4055

Comments