Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
RHEL 8, for certificate-based authentication, must enforce authorized access to the corresponding private key.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-230230 | RHEL-08-010100 | SV-230230r627750_rule | Medium |
| Description |
|---|
| If an unauthorized user obtains access to a private key without a passcode, that user would have unauthorized access to any system where the associated public key has been installed. |
| STIG | Date |
|---|---|
| Red Hat Enterprise Linux 8 Security Technical Implementation Guide | 2023-03-08 |
Details
| Check Text ( C-32899r567436_chk ) |
|---|
| Verify the SSH private key files have a passcode. For each private key stored on the system, use the following command: $ sudo ssh-keygen -y -f /path/to/file If the contents of the key are displayed, this is a finding. |
| Fix Text (F-32874r567437_fix) |
|---|
| Create a new private and public key pair that utilizes a passcode with the following command: $ sudo ssh-keygen -n [passphrase] |