Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
OL 8, for certificate-based authentication, must enforce authorized access to the corresponding private key.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-248532 | OL08-00-010100 | SV-248532r958450_rule | Medium |
| Description |
|---|
| If an unauthorized user obtains access to a private key without a passcode, that user would have unauthorized access to any system where the associated public key has been installed. |
| STIG | Date |
|---|---|
| Oracle Linux 8 Security Technical Implementation Guide | 2024-06-04 |
Details
| Check Text ( C-51966r779160_chk ) |
|---|
| Verify the SSH private key files have a passcode. For each private key stored on the system, use the following command: $ sudo ssh-keygen -y -f /path/to/file If the contents of the key are displayed, this is a finding. |
| Fix Text (F-51920r779161_fix) |
|---|
| Create a new private and public key pair that uses a passcode with the following command: $ sudo ssh-keygen -n [passphrase] |