Capacity
CCI-000186
For public key-based authentication, enforce authorized access to the corresponding private key.
3
Rule
Severity: Medium
OpenSSH Service Must Use Passcode for Their Private Keys
2
Rule
Severity: Medium
AAA Services must be configured to enforce authorized access to the corresponding private key for PKI-based authentication.
4
Rule
Severity: Medium
Only authenticated system administrators or the designated PKI Sponsor for the Apache web server must have access to the Apache web servers private key.
2
Rule
Severity: Medium
Only authenticated system administrators or the designated PKI Sponsor for the application server must have access to the web servers private key.
2
Rule
Severity: High
The application, when using PKI-based authentication, must enforce authorized access to the corresponding private key.
2
Rule
Severity: Medium
The TSIG keys used with the BIND 9.x implementation must be owned by a privileged account.
2
Rule
Severity: Medium
The TSIG keys used with the BIND 9.x implementation must be group owned by a privileged account.
2
Rule
Severity: Medium
The read and write access to a TSIG key file used by a BIND 9.x server must be restricted to only the account that runs the name server software.
2
Rule
Severity: High
The BIND 9.x server private key corresponding to the ZSK pair must be the only DNSSEC key kept on a name server that supports dynamic updates.
2
Rule
Severity: High
The BIND 9.x server signature generation using the KSK must be done off-line, using the KSK-private key stored off-line.
2
Rule
Severity: High
The Central Log Server, when using PKI-based authentication, must enforce authorized access to the corresponding private key.
1
Rule
Severity: Medium
The certificate chain used by Universal Control Plane (UCP) client bundles must match what is defined in the System Security Plan (SSP) in Docker Enterprise.
1
Rule
Severity: Medium
Docker Enterprise Swarm manager must be run in auto-lock mode.
1
Rule
Severity: Medium
Docker Enterprise secret management commands must be used for managing secrets in a Swarm cluster.
2
Rule
Severity: Medium
The DNS server implementation, when using PKI-based authentication, must enforce authorized access to the corresponding private key.
2
Rule
Severity: Medium
The key file must be owned by the account under which the name server software is run.
2
Rule
Severity: Medium
Read/Write access to the key file must be restricted to the account that runs the name server software only.
3
Rule
Severity: Medium
Only the private key corresponding to the ZSK alone must be kept on the name server that does support dynamic updates.
3
Rule
Severity: Medium
Signature generation using the KSK must be done off-line, using the KSK-private stored off-line.
2
Rule
Severity: Medium
A unique TSIG key must be generated for each pair of communicating hosts.
1
Rule
Severity: Medium
Infoblox systems that communicate with non-Grid name servers must use a unique Transaction Signature (TSIG).
1
Rule
Severity: High
The Infoblox Grid Master must be configured as a stealth (hidden) domain name server in order to protect the Key Signing Key (KSK) residing on it.
1
Rule
Severity: High
The Infoblox Grid Master must be configured as a stealth (hidden) domain name server in order to protect the Zone Signing Key (ZSK) residing on it.
1
Rule
Severity: High
The WebSphere Application Server default keystore passwords must be changed.
1
Rule
Severity: Medium
The IBM z/VM TCP/IP Key database for LDAP or SSL server must be created with the proper permissions.
2
Rule
Severity: Medium
The JBoss server must be configured to restrict access to the web servers private key to authenticated system administrators.
2
Rule
Severity: Medium
The Mainframe Product, when using PKI-based authentication, must enforce authorized access to the corresponding private key.
1
Rule
Severity: Medium
The Windows 2012 DNS Server must be configured to enforce authorized access to the corresponding private key.
1
Rule
Severity: Medium
The Windows 2012 DNS Server key file must be owned by the account under which the Windows 2012 DNS Server service is run.
1
Rule
Severity: Medium
The Windows 2012 DNS Server permissions must be set so that the key file can only be read or modified by the account that runs the name server software.
1
Rule
Severity: Medium
The private key corresponding to the ZSK must only be stored on the name server that does support dynamic updates.
1
Rule
Severity: Medium
Access to the SDN management and orchestration systems must be authenticated using a FIPS-approved message authentication code algorithm.
1
Rule
Severity: Medium
Southbound API management plane traffic for provisioning and configuring virtual network elements within the SDN infrastructure must be authenticated using a FIPS-approved message authentication code algorithm.
1
Rule
Severity: Medium
Southbound API management plane traffic for configuring SDN parameters on physical network elements must be authenticated using DOD PKI certificate-based authentication.
1
Rule
Severity: High
Innoslate must use multifactor authentication for network access to privileged and non-privileged accounts.
2
Rule
Severity: High
The Tanium Server certificate and private/public keys directory must be protected with appropriate permissions.
2
Rule
Severity: Medium
The UEM Agent must use managed endpoint device key storage for all persistent secret and private keys.
2
Rule
Severity: Medium
The UEM server, when using PKI-based authentication, must enforce authorized access to the corresponding private key.
2
Rule
Severity: Medium
The site-to-site VPN, when using PKI-based authentication for devices, must enforce authorized access to the corresponding private key.
2
Rule
Severity: Medium
The Apache web server must be configured to use a specified IP address and port.
2
Rule
Severity: High
Default password for keystore must be changed.
2
Rule
Severity: Medium
Keystore file must be protected.
1
Rule
Severity: Medium
The macOS system must accept and verify Personal Identity Verification (PIV) credentials, implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network, and only allow the use of DoD PKI-established certificate authorities for verification of the establishment of protected sessions.
3
Rule
Severity: Medium
The macOS system must accept and verify Personal Identity Verification (PIV) credentials, implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network, and only allow the use of DOD PKI-established certificate authorities for verification of the establishment of protected sessions.
3
Rule
Severity: High
The macOS system must disable password authentication for SSH.
3
Rule
Severity: Medium
The macOS system must enforce smart card authentication.
3
Rule
Severity: High
PostgreSQL must enforce authorized access to all PKI private keys stored/utilized by PostgreSQL.
2
Rule
Severity: High
The EDB Postgres Advanced Server must enforce authorized access to all PKI private keys stored/used by the EDB Postgres Advanced Server.
2
Rule
Severity: High
The DBMS must enforce authorized access to all PKI private keys stored/utilized by the DBMS.
2
Rule
Severity: Medium
The operating system, for PKI-based authentication, must enforce authorized access to the corresponding private key.
2
Rule
Severity: Medium
SSMC web server application, libraries, and configuration files must only be accessible to privileged users.
2
Rule
Severity: Medium
AIX SSH private host key files must have mode 0600 or less permissive.
2
Rule
Severity: Medium
IBM z/OS for PKI-based authentication must use ICSF or the ESM to store keys.
2
Rule
Severity: Medium
IBM z/OS must use ICSF or SAF Key Rings for key management.
2
Rule
Severity: High
MarkLogic Server must enforce authorized access to all PKI private keys stored/utilized by the DBMS.
2
Rule
Severity: High
MariaDB must enforce authorized access to all PKI private keys stored/used by the DBMS.
2
Rule
Severity: High
MongoDB must enforce authorized access to all PKI private keys stored/utilized by MongoDB.
2
Rule
Severity: Medium
Encryption keys used for the .NET Strong Name Membership Condition must be protected.
2
Rule
Severity: High
SQL Server must enforce authorized access to all PKI private keys stored/utilized by SQL Server.
2
Rule
Severity: Medium
Users must be required to enter a password to access private keys stored on the computer.
2
Rule
Severity: Medium
Windows Server 2019 users must be required to enter a password to access private keys stored on the computer.
2
Rule
Severity: Medium
Windows Server 2022 users must be required to enter a password to access private keys stored on the computer.
3
Rule
Severity: High
The DBMS, when using PKI-based authentication, must enforce authorized access to the corresponding private key.
2
Rule
Severity: Medium
OL 8, for certificate-based authentication, must enforce authorized access to the corresponding private key.
2
Rule
Severity: High
The MySQL Database Server 8.0 must enforce authorized access to all PKI private keys stored/utilized by the MySQL Database Server 8.0.
2
Rule
Severity: High
Redis Enterprise DBMS must enforce authorized access to all PKI private keys stored/used by Redis Enterprise DBMS.
2
Rule
Severity: Medium
RHEL 8, for certificate-based authentication, must enforce authorized access to the corresponding private key.
2
Rule
Severity: Medium
Only authenticated system administrators or the designated PKI Sponsor for an Automation Controller NGINX web server must have access to any Automation Controller NGINX web server's private key.
2
Rule
Severity: Medium
RHEL 9, for PKI-based authentication, must enforce authorized access to the corresponding private key.
2
Rule
Severity: Medium
The VMM, for PKI-based authentication, must enforce authorized access to the corresponding private key.
1
Rule
Severity: Medium
VAMI must protect the keystore from unauthorized access.
1
Rule
Severity: High
VMware Postgres must enforce authorized access to all public key infrastructure (PKI) private keys.
1
Rule
Severity: Medium
The Envoy private key file must be protected from unauthorized access.
3
Rule
Severity: Medium
The vCenter Envoy service private key file must be protected from unauthorized access.
2
Rule
Severity: High
The vCenter PostgreSQL service must enforce authorized access to all PKI private keys stored/utilized by PostgreSQL.
3
Rule
Severity: Medium
The vCenter VAMI service must restrict access to the web server's private key.
2
Rule
Severity: Medium
Only authenticated system administrators or the designated PKI Sponsor for the web server must have access to the web servers private key.
1
Rule
Severity: High
The EDB Postgres Advanced Server must enforce authorized access to all PKI private keys stored/utilized by the EDB Postgres Advanced Server.
2
Rule
Severity: Medium
The Windows DNS Server must be configured to enforce authorized access to the corresponding private key.
2
Rule
Severity: Medium
The Windows DNS Server key file must be owned by the account under which the Windows DNS Server service is run.
2
Rule
Severity: Medium
The Windows DNS Server permissions must be set so the key file can only be read or modified by the account that runs the name server software.
2
Rule
Severity: Medium
The private key corresponding to the zone signing key (ZSK) must only be stored on the name server that does support dynamic updates.
2
Rule
Severity: Medium
A unique Transaction Signature (TSIG) key must be generated for each pair of communicating hosts.
1
Rule
Severity: High
PostgreSQL must enforce authorized access to all PKI private keys stored/used by PostgreSQL.
1
Rule
Severity: Medium
Dragos Platform must accept the DOD CAC or other PKI credential for identity management and personal authentication.
1
Rule
Severity: High
MongoDB must enforce authorized access to all PKI private keys stored/used by MongoDB.
1
Rule
Severity: Medium
SLEM 5, for PKI-based authentication, must enforce authorized access to the corresponding private key.
1
Rule
Severity: Medium
TOSS, for PKI-based authentication, must enforce authorized access to the corresponding private key.
Patternfly
PatternFly elements
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.
Modules