STIGQter: STIG Summary: Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide Version: 2 Release: 9 Benchmark Date: 01 Jul 2026:

Ubuntu 22.04 LTS must map the authenticated identity to the user or group account for PKI-based authentication.

DISA Rule

SV-260579r958452_rule

Vulnerability Number

V-260579

Group Title

SRG-OS-000068-GPOS-00036

Rule Version

UBTU-22-612040

Severity

CAT I

CCI(s)

• CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.

Weight

10

Fix Recommendation

Set "use_mappers=pwent" in "/etc/pam_pkcs11/pam_pkcs11.conf" or, if there is already a comma-separated list of mappers, add it to the list, separated by comma, and before the null mapper.

If the system is missing an "/etc/pam_pkcs11/" directory and an "/etc/pam_pkcs11/pam_pkcs11.conf", find an example to copy into place and modify accordingly at "/usr/share/doc/libpam-pkcs11/examples/pam_pkcs11.conf.example.gz".

Check Contents

Verify that "use_mappers" is set to "pwent" in "/etc/pam_pkcs11/pam_pkcs11.conf" file by using the following command:

$ grep -i use_mappers /etc/pam_pkcs11/pam_pkcs11.conf
use_mappers = pwent

If "use_mappers" does not contain "pwent", is commented out, or is missing, this is a finding.

Vulnerability Number

V-260579

Documentable

False

Rule Version

UBTU-22-612040

Severity Override Guidance

Verify that "use_mappers" is set to "pwent" in "/etc/pam_pkcs11/pam_pkcs11.conf" file by using the following command:

$ grep -i use_mappers /etc/pam_pkcs11/pam_pkcs11.conf
use_mappers = pwent

If "use_mappers" does not contain "pwent", is commented out, or is missing, this is a finding.

Check Content Reference

M

Target Key

5594