STIGQter: STIG Summary: SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

SLEM 5 must implement certificate status checking for multifactor authentication.

DISA Rule

SV-261398r996615_rule

Vulnerability Number

V-261398

Group Title

SRG-OS-000375-GPOS-00160

Rule Version

SLEM-05-612020

Severity

CAT II

CCI(s)

• CCI-001953 - Accepts Personal Identity Verification-compliant credentials.
• CCI-001954 - Electronically verifies Personal Identity Verification-compliant credentials.

Weight

10

Fix Recommendation

Configure SLEM 5 to certificate status checking for PKI authentication.

Modify all of the cert_policy lines in "/etc/pam_pkcs11/pam_pkcs11.conf" to include "ocsp_on".

Note: OCSP allows sending request for certificate status information. Additional certificate validation polices are permitted.

Additional information on the configuration of multifactor authentication on SLEM 5 can be found at https://www.suse.com/communities/blog/configuring-smart-card-authentication-suse-linux-enterprise/.

Check Contents

Verify SLEM 5 implements certificate status checking for multifactor authentication with the following command:

> grep use_pkcs11_module /etc/pam_pkcs11/pam_pkcs11.conf | awk '/pkcs11_module coolkey {/,/}/' /etc/pam_pkcs11/pam_pkcs11.conf | grep cert_policy
cert_policy = ca,ocsp_on,signature,crl_auto;

If "cert_policy" is not set to include "ocsp", this is a finding.

Vulnerability Number

V-261398

Documentable

False

Rule Version

SLEM-05-612020

Severity Override Guidance

Verify SLEM 5 implements certificate status checking for multifactor authentication with the following command:

> grep use_pkcs11_module /etc/pam_pkcs11/pam_pkcs11.conf | awk '/pkcs11_module coolkey {/,/}/' /etc/pam_pkcs11/pam_pkcs11.conf | grep cert_policy
cert_policy = ca,ocsp_on,signature,crl_auto;

If "cert_policy" is not set to include "ocsp", this is a finding.

Check Content Reference

M

Target Key

5596