Details

If an unauthorized user obtains access to a private key without a passcode, that user would have unauthorized access to any system where the associated public key has been installed.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Create a new private and public key pair that uses a passcode with the following command:

$ sudo ssh-keygen -n [passphrase]

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Linux_8_V1R1_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Identification and Authentication.This control applies to the following type of system Unix.

References

• 800-53|IA-5(2)(b)
• CAT|II
• CCI|CCI-000186
• Rule-ID|SV-248532r779162_rule
• STIG-ID|OL08-00-010100
• Vuln-ID|V-248532

Source

• Tenable.com/audits