STIGQter: STIG Summary: Cloud Linux AlmaLinux OS 9 Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 01 Jul 2026:

AlmaLinux OS 9 must implement certificate status checking for multifactor authentication.

DISA Rule

SV-269371r1050254_rule

Vulnerability Number

V-269371

Group Title

SRG-OS-000375-GPOS-00160

Rule Version

ALMA-09-033680

Severity

CAT II

CCI(s)

• CCI-004046 - Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.

Weight

10

Fix Recommendation

Edit the file "/etc/sssd/sssd.conf" or a "*.conf" file within the "/etc/sssd/conf.d/" directory and add or edit the following line within the [sssd] section:

certificate_verification = ocsp_dgst=sha512

Check Contents

Note: If the system administrator (SA) demonstrates the use of an approved alternate multifactor authentication method, this requirement is Not Applicable.

Verify the operating system implements Online Certificate Status Protocol (OCSP) and is using the proper digest value on the system with the following command:

$ grep certificate_verification /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf

/etc/sssd/conf.d/certificate_verification.conf:certificate_verification = ocsp_dgst=sha512

If the certificate_verification line is missing from the [sssd] section, or is missing "ocsp_dgst=sha512", ask the administrator to indicate what type of multifactor authentication is being used and how the system implements certificate status checking. If there is no evidence of certificate status checking being used, this is a finding.

Vulnerability Number

V-269371

Documentable

False

Rule Version

ALMA-09-033680

Severity Override Guidance

Note: If the system administrator (SA) demonstrates the use of an approved alternate multifactor authentication method, this requirement is Not Applicable.

Verify the operating system implements Online Certificate Status Protocol (OCSP) and is using the proper digest value on the system with the following command:

$ grep certificate_verification /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf

/etc/sssd/conf.d/certificate_verification.conf:certificate_verification = ocsp_dgst=sha512

If the certificate_verification line is missing from the [sssd] section, or is missing "ocsp_dgst=sha512", ask the administrator to indicate what type of multifactor authentication is being used and how the system implements certificate status checking. If there is no evidence of certificate status checking being used, this is a finding.

Check Content Reference

M

Target Key

5664