5.10 Ensure enable smartcard authentication is set to true

Information

The operating system must uniquely identify and must authenticate users using multifactor authentication via a graphical user logon.

Rationale:

To assure accountability and prevent unauthenticated access, users must be identified and authenticated to prevent potential misuse and compromise of the system.

Multifactor solutions that require devices separate from information systems gaining access include, for example, hardware tokens providing time-based or challenge-response authenticators and smart cards such as the U.S. Government Personal Identity Verification card and the DoD Common Access Card.

Solution

Configure the operating system to uniquely identify and authenticate users using multifactor authentication via a graphical user logon.
Create a database to contain the system-wide screensaver settings (if it does not already exist) with the following command:
Note: The example is using the database local for the system, so if the system is using another database in /etc/dconf/profile/user, the file should be created under the appropriate subdirectory.

# touch /etc/dconf/db/local.d/00-defaults

Edit [org/gnome/login-screen] and add or update the following line:

enable-smartcard-authentication=true

Update the system databases:

# dconf update

Notes:

This Benchmark recommendation maps to:

Red Hat Enterprise Linux 7 Security Technical Implementation Guide:

Version 2, Release: 3 Benchmark Date: 26 Apr 2019



Vul ID: V-77819

Rule ID: SV-92515r2_rule

STIG ID: RHEL-07-010061

Severity: CAT II

See Also

https://workbench.cisecurity.org/files/2688

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(11)

Plugin: Unix

Control ID: dbaec095e55e74b74003af8106cd7b9f83b8784d8bb70439c073a1bc12223d1d