STIGQter STIGQter: STIG Summary: SUSE Linux Enterprise Micro (SLEM) 5 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Apr 2026:

SLEM 5, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

DISA Rule

SV-261401r996622_rule

Vulnerability Number

V-261401

Group Title

SRG-OS-000066-GPOS-00034

Rule Version

SLEM-05-631020

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure SLEM 5 for PKI-based authentication to validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.

Modify all of the cert_policy lines in "/etc/pam_pkcs11/pam_pkcs11.conf" to include "ca":

cert_policy = ca,signature,oscp_on;

Note: Additional certificate validation polices are permitted.

Additional information on the configuration of multifactor authentication on SLEM 5 can be found at https://www.suse.com/communities/blog/configuring-smart-card-authentication-suse-linux-enterprise/.

Check Contents

Verify SLEM 5 for PKI-based authentication had valid certificates by constructing a certification path (which includes status information) to an accepted trust anchor with the following command:

> grep cert_policy /etc/pam_pkcs11/pam_pkcs11.conf
cert_policy = ca,oscp_on,signature,crl_auto;

If "cert_policy" is not set to include "ca" on all returned lines, this is a finding.

Vulnerability Number

V-261401

Documentable

False

Rule Version

SLEM-05-631020

Severity Override Guidance

Verify SLEM 5 for PKI-based authentication had valid certificates by constructing a certification path (which includes status information) to an accepted trust anchor with the following command:

> grep cert_policy /etc/pam_pkcs11/pam_pkcs11.conf
cert_policy = ca,oscp_on,signature,crl_auto;

If "cert_policy" is not set to include "ca" on all returned lines, this is a finding.

Check Content Reference

M

Target Key

5596