Audits
Settings
Links
Tenable Cloud
Tenable Community & Support
Tenable University
Theme
Light
Dark
Auto
Help
Plugins
Overview
Plugins Pipeline
Newest
Updated
Search
Nessus Families
WAS Families
NNM Families
LCE Families
Tenable OT Security Families
About Plugin Families
Release Notes
Audits
Overview
Newest
Updated
Search Audit Files
Search Items
References
Authorities
Documentation
Download All Audit Files
Indicators
Overview
Search
Indicators of Attack
Indicators of Exposure
CVEs
Overview
Newest
Updated
Search
Attack Path Techniques
Overview
Search
Links
Tenable Cloud
Tenable Community & Support
Tenable University
Settings
Theme
Light
Dark
Auto
Detections
Plugins
Overview
Plugins Pipeline
Release Notes
Newest
Updated
Search
Nessus Families
WAS Families
NNM Families
LCE Families
Tenable OT Security Families
About Plugin Families
Audits
Overview
Newest
Updated
Search Audit Files
Search Items
References
Authorities
Documentation
Download All Audit Files
Indicators
Overview
Search
Indicators of Attack
Indicators of Exposure
Analytics
CVEs
Overview
Newest
Updated
Search
Attack Path Techniques
Overview
Search
Audits
References
CCI
CCI-000186
CCI
CCI|CCI-000186
Title
For public key-based authentication, enforce authorized access to the corresponding private key.
Reference Item Details
Reference:
CCI - DISA Control Correlation Identifier
Category:
2024
Audit Items
View all Reference Audit Items
Name
Plugin
Audit Name
AIX7-00-003004 - AIX SSH private host key files must have mode 0600 or less permissive.
Unix
DISA STIG AIX 7.x v2r9
AOSX-13-067035 - The macOS system must enable certificate for smartcards.
Unix
DISA STIG Apple Mac OSX 10.13 v2r5
AOSX-14-003002 - The macOS system must enable certificate for smartcards.
Unix
DISA STIG Apple Mac OSX 10.14 v2r6
APPL-14-001150 - The macOS system must disable password authentication for SSH.
Unix
DISA Apple macOS 14 (Sonoma) STIG v2r1
APPL-14-003020 - The macOS system must enforce smart card authentication.
Unix
DISA Apple macOS 14 (Sonoma) STIG v2r1
APPL-15-001150 - The macOS system must disable password authentication for SSH.
Unix
DISA Apple macOS 15 (Sequoia) STIG v1r1
APPL-15-003020 - The macOS system must enforce smart card authentication.
Unix
DISA Apple macOS 15 (Sequoia) STIG v1r1
APPNET0052 - Encryption keys used for the .NET Strong Name Membership Condition must be protected.
Windows
DISA STIG for Microsoft Dot Net Framework 4.0 v2r4
AS24-U1-000360 - The Apache web server must be configured to use a specified IP address and port.
Unix
DISA STIG Apache Server 2.4 Unix Server v3r1 Middleware
AS24-U1-000360 - The Apache web server must be configured to use a specified IP address and port.
Unix
DISA STIG Apache Server 2.4 Unix Server v3r1
AS24-U2-000390 - Only authenticated system administrators or the designated PKI Sponsor for the Apache web server must have access to the Apache web servers private key.
Unix
DISA STIG Apache Server 2.4 Unix Site v2r4
AS24-U2-000390 - Only authenticated system administrators or the designated PKI Sponsor for the Apache web server must have access to the Apache web servers private key.
Unix
DISA STIG Apache Server 2.4 Unix Site v2r4 Middleware
AS24-W2-000390 - Only authenticated system administrators or the designated PKI Sponsor for the Apache web server must have access to the Apache web servers private key.
Windows
DISA STIG Apache Server 2.4 Windows Site v2r1
Big Sur - Set Smartcard Certificate Trust to Moderate
Unix
NIST macOS Big Sur v1.4.0 - 800-53r5 Moderate
Big Sur - Set Smartcard Certificate Trust to Moderate
Unix
NIST macOS Big Sur v1.4.0 - 800-53r4 Moderate
Big Sur - Set Smartcard Certificate Trust to Moderate
Unix
NIST macOS Big Sur v1.4.0 - All Profiles
Big Sur - Set Smartcard Certificate Trust to Moderate
Unix
NIST macOS Big Sur v1.4.0 - CNSSI 1253
BIND-9X-001110 - The TSIG keys used with the BIND 9.x implementation must be owned by a privileged account.
Unix
DISA BIND 9.x STIG v2r3
BIND-9X-001111 - The TSIG keys used with the BIND 9.x implementation must be group owned by a privileged account.
Unix
DISA BIND 9.x STIG v2r3
BIND-9X-001112 - The read and write access to a TSIG key file used by a BIND 9.x server must be restricted to only the account that runs the name server software.
Unix
DISA BIND 9.x STIG v2r3
BIND-9X-001133 - The BIND 9.x server private key corresponding to the ZSK pair must be the only DNSSEC key kept on a name server that supports dynamic updates.
Unix
DISA BIND 9.x STIG v2r3
BIND-9X-001150 - The BIND 9.x server signature generation using the KSK must be done off-line, using the KSK-private key stored off-line.
Unix
DISA BIND 9.x STIG v2r3
Catalina - Set Smartcard Certificate Trust to High
Unix
NIST macOS Catalina v1.5.0 - All Profiles
Catalina - Set Smartcard Certificate Trust to High
Unix
NIST macOS Catalina v1.5.0 - 800-53r5 High
Catalina - Set Smartcard Certificate Trust to High
Unix
NIST macOS Catalina v1.5.0 - 800-53r4 High
Catalina - Set Smartcard Certificate Trust to Moderate
Unix
NIST macOS Catalina v1.5.0 - 800-53r4 Moderate
Catalina - Set Smartcard Certificate Trust to Moderate
Unix
NIST macOS Catalina v1.5.0 - All Profiles
Catalina - Set Smartcard Certificate Trust to Moderate
Unix
NIST macOS Catalina v1.5.0 - 800-53r5 Moderate
Catalina - Set Smartcard Certificate Trust to Moderate
Unix
NIST macOS Catalina v1.5.0 - CNSSI 1253
CD12-00-010200 - PostgreSQL must enforce authorized access to all PKI private keys stored/utilized by PostgreSQL.
Unix
DISA STIG Crunchy Data PostgreSQL OS v3r1
DKER-EE-002380 - The certificate chain used by Universal Control Plane (UCP) client bundles must match what is defined in the System Security Plan (SSP) in Docker Enterprise.
Unix
DISA STIG Docker Enterprise 2.x Linux/Unix v2r2
DKER-EE-002400 - Docker Enterprise Swarm manager must be run in auto-lock mode.
Unix
DISA STIG Docker Enterprise 2.x Linux/Unix v2r2
DKER-EE-002410 - Docker Enterprise secret management commands must be used for managing secrets in a Swarm cluster.
Unix
DISA STIG Docker Enterprise 2.x Linux/Unix v2r2
EP11-00-004600 - The EDB Postgres Advanced Server must enforce authorized access to all PKI private keys stored/utilized by the EDB Postgres Advanced Server.
Windows
EDB PostgreSQL Advanced Server v11 Windows OS Audit v2r4
EPAS-00-004600 - The EDB Postgres Advanced Server must enforce authorized access to all PKI private keys stored/used by the EDB Postgres Advanced Server.
Unix
EnterpriseDB PostgreSQL Advanced Server OS Linux v2r1
GEN005523 - The SSH private host key files must have mode 0600 or less permissive.
Unix
DISA STIG for Oracle Linux 5 v2r1
JBOS-AS-000320 - The JBoss server must be configured to restrict access to the web servers private key to authenticated system administrators.
Unix
DISA RedHat JBoss EAP 6.3 STIG v2r4
MADB-10-004100 - MariaDB must enforce authorized access to all PKI private keys stored/used by the DBMS.
MySQLDB
DISA MariaDB Enterprise 10.x v2r1 DB
MD3X-00-000360 - MongoDB must enforce authorized access to all PKI private keys stored/utilized by MongoDB.
Unix
DISA STIG MongoDB Enterprise Advanced 3.x v2r3 OS
MD4X-00-003100 - MongoDB must enforce authorized access to all PKI private keys stored/utilized by MongoDB.
Unix
DISA STIG MongoDB Enterprise Advanced 4.x v1r4 OS
Monterey - Set Smartcard Certificate Trust to High
Unix
NIST macOS Monterey v1.0.0 - 800-53r5 High
Monterey - Set Smartcard Certificate Trust to High
Unix
NIST macOS Monterey v1.0.0 - All Profiles
Monterey - Set Smartcard Certificate Trust to High
Unix
NIST macOS Monterey v1.0.0 - 800-53r4 High
Monterey - Set Smartcard Certificate Trust to Moderate
Unix
NIST macOS Monterey v1.0.0 - CNSSI 1253
Monterey - Set Smartcard Certificate Trust to Moderate
Unix
NIST macOS Monterey v1.0.0 - 800-53r4 Moderate
Monterey - Set Smartcard Certificate Trust to Moderate
Unix
NIST macOS Monterey v1.0.0 - 800-53r5 Moderate
Monterey - Set Smartcard Certificate Trust to Moderate
Unix
NIST macOS Monterey v1.0.0 - All Profiles
MYS8-00-004800 - The MySQL Database Server 8.0 must enforce authorized access to all PKI private keys stored/utilized by the MySQL Database Server 8.0.
MySQLDB
DISA Oracle MySQL 8.0 v2r1 DB
MYS8-00-004800 - The MySQL Database Server 8.0 must enforce authorized access to all PKI private keys stored/utilized by the MySQL Database Server 8.0.
Unix
DISA Oracle MySQL 8.0 v2r1 OS Linux
O112-C1-015400 - The DBMS, when using PKI-based authentication, must enforce authorized access to the corresponding private key.
Windows
DISA STIG Oracle 11.2g v2r5 Windows
