STIGQter: STIG Summary: Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

Ubuntu 22.04 LTS must implement smart card logins for multifactor authentication for local and network access to privileged and nonprivileged accounts.

DISA Rule

SV-260575r1044770_rule

Vulnerability Number

V-260575

Group Title

SRG-OS-000105-GPOS-00052

Rule Version

UBTU-22-612020

Severity

CAT II

CCI(s)

• CCI-000765 - Implement multifactor authentication for network access to privileged accounts.
• CCI-000766 - Implement multifactor authentication for network access to non-privileged accounts.
• CCI-004047 - Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that the device meets organization-defined strength of mechanism requirements.

Weight

10

Fix Recommendation

Configure Ubuntu 22.04 LTS to use multifactor authentication for access to accounts.

Add or modify the following line in the "/etc/pam.d/common-auth" file:

auth [success=3 default=ignore] pam_pkcs11.so

Add or modify the following line in the "/etc/ssh/sshd_config" file:

PubkeyAuthentication yes

Check Contents

Verify that the "pam_pkcs11.so" module is configured by using the following command:

$ grep -i pam_pkcs11.so /etc/pam.d/common-auth
auth [success=3 default=ignore] pam_pkcs11.so

If "pam_pkcs11.so" is commented out or is missing, this is a finding.

Verify the sshd daemon allows public key authentication by using the following command:

$ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'pubkeyauthentication'
/etc/ssh/sshd_config:PubkeyAuthentication yes

If "PubkeyAuthentication" is not set to "yes" or is commented out or missing, or if conflicting results are returned, this is a finding.

Vulnerability Number

V-260575

Documentable

False

Rule Version

UBTU-22-612020

Severity Override Guidance

Verify that the "pam_pkcs11.so" module is configured by using the following command:

$ grep -i pam_pkcs11.so /etc/pam.d/common-auth
auth [success=3 default=ignore] pam_pkcs11.so

If "pam_pkcs11.so" is commented out or is missing, this is a finding.

Verify the sshd daemon allows public key authentication by using the following command:

$ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH 'pubkeyauthentication'
/etc/ssh/sshd_config:PubkeyAuthentication yes

If "PubkeyAuthentication" is not set to "yes" or is commented out or missing, or if conflicting results are returned, this is a finding.

Check Content Reference

M

Target Key

5594