plus3it / plus3it/ash-linux-formula
[Feature Request] Compliance Setting: "OS must validate certificates for PKI-based authentication by constructing a certification path to an accepted trust anchor"
Nobody has claimed this yet.
- Dominant language
- SaltStack
- Stars
- 19
- Forks
- 17
- PR merge metrics
- No merged PRs in 30d
Description
Is your feature request related to a problem? Please describe.
STIG scans calling out RHEL-09-631010/OL09-00-000900/ALMA-09-039070
Describe the solution you'd like
Per the STIG guidance:
Configure the OS for PKI-based authentication, to validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.
Obtain a valid copy of the DOD root CA file from the PKI CA certificate bundle from cyber.mil and copy the
DoD_PKE_CA_chain.peminto the following file:/etc/sssd/pki/sssd_auth_ca_db.pem
Describe alternatives you've considered
Additional context
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the STIG guidance and the requested /etc/sssd/pki/sssd_auth_ca_db.pem location, including the referenced DoD_PKE_CA_chain.pem bundle. Inspect how the formula currently manages SSSD configuration, then verify that the accepted trust-anchor chain is installed at the requested path and satisfies the cited STIG checks.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100