For PKI-based authentication, NixOS must implement a local cache of revocation data to support path discovery and validation in case of the inability to access revocation information via the network.
An XCCDF Rule
Description
Without configuring a local cache of revocation data, there is the potential to allow access to users who are no longer authorized (users with revoked certificates).
- ID
- SV-268179r1039545_rule
- Version
- ANIX-00-002060
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure the NixOS operating system, for PKI-based authentication, to use local revocation data when unable to access the network to obtain it remotely.
Add the following Nix code to the NixOS Configuration usually located in /etc/nixos/configuration.nix:
security.pam.p11.enable = true;
environment.etc."pam_pkcs11/pam_pkcs11.conf".text = ''