The operating system must uniquely identify and must authenticate users using multifactor authentication via a graphical user logon.

From Red Hat Enterprise Linux 7 Security Technical Implementation Guide

Part of SRG-OS-000375-GPOS-00160

Associated with: CCI-001948 CCI-001953 CCI-001954

SV-92515r1_rule The operating system must uniquely identify and must authenticate users using multifactor authentication via a graphical user logon.

Vulnerability discussion

To assure accountability and prevent unauthenticated access, users must be identified and authenticated to prevent potential misuse and compromise of the system.Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.Satisfies: SRG-OS-000375-GPOS-00161,SRG-OS-000375-GPOS-00162

Check content

Verify the operating system uniquely identifies and authenticates users using multifactor authentication via a graphical user logon. Note: If the system does not have GNOME installed, this requirement is Not Applicable. Determine which profile the system database is using with the following command: # grep system-db /etc/dconf/profile/user system-db:local Note: The example is using the database local for the system, so the path is "/etc/dconf/db/local.d". This path must be modified if a database other than local is being used. # grep enable-smartcard-authentication /etc/dconf/db/local.d/* enable-smartcard-authentication=true If "enable-smartcard-authentication" is set to "false" or the keyword is missing, this is a finding.

Fix text

Configure the operating system to uniquely identify and authenticate users using multifactor authentication via a graphical user logon. Note: If the system does not have GNOME installed, this requirement is Not Applicable. Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following command: Note: The example is using the database local for the system, so if the system is using another database in "/etc/dconf/profile/user", the file should be created under the appropriate subdirectory. # touch /etc/dconf/db/local.d/00-defaults Add the setting to enable smartcard login: enable-smartcard-authentication=true

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer