STIGQter: STIG Summary: Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

Ubuntu 22.04 LTS must electronically verify personal identity verification (PIV) credentials.

DISA Rule

SV-260576r1069114_rule

Vulnerability Number

V-260576

Group Title

SRG-OS-000377-GPOS-00162

Rule Version

UBTU-22-612025

Severity

CAT II

CCI(s)

• CCI-001954 - Electronically verifies Personal Identity Verification-compliant credentials.

Weight

10

Fix Recommendation

Configure Ubuntu 22.04 LTS to do certificate status checking for multifactor authentication.

Add or modify all "cert_policy" lines in the "/etc/pam_pkcs11/pam_pkcs11.conf" file with the following:

ocsp_on

Check Contents

Verify Ubuntu 22.04 LTS electronically verifies PIV credentials via certificate status checking by using the following command:

$ sudo grep use_pkcs11_module /etc/pam_pkcs11/pam_pkcs11.conf | sudo awk '/pkcs11_module opensc {/,/}/' /etc/pam_pkcs11/pam_pkcs11.conf | grep cert_policy | grep ocsp_on
cert_policy = ca,signature,ocsp_on;

If every returned "cert_policy" line is not set to "ocsp_on", the line is commented out, or is missing, this is a finding.

Vulnerability Number

V-260576

Documentable

False

Rule Version

UBTU-22-612025

Severity Override Guidance

Verify Ubuntu 22.04 LTS electronically verifies PIV credentials via certificate status checking by using the following command:

$ sudo grep use_pkcs11_module /etc/pam_pkcs11/pam_pkcs11.conf | sudo awk '/pkcs11_module opensc {/,/}/' /etc/pam_pkcs11/pam_pkcs11.conf | grep cert_policy | grep ocsp_on
cert_policy = ca,signature,ocsp_on;

If every returned "cert_policy" line is not set to "ocsp_on", the line is commented out, or is missing, this is a finding.

Check Content Reference

M

Target Key

5594