Skip to content
Log In

Disable Certmonger Service (certmonger)

An XCCDF Rule

Description

Certmonger is a D-Bus based service that attempts to simplify interaction with certifying authorities on networks which use public-key infrastructure. It is often combined with Red Hat's IPA (Identity Policy Audit) security information management solution to aid in the management of certificates. The certmonger service can be disabled with the following command: 
$ sudo systemctl mask --now certmonger.service

Rationale

The services provided by certmonger may be essential for systems fulfilling some roles a PKI infrastructure, but its functionality is not necessary for many other use cases.

ID
xccdf_org.ssgproject.content_rule_service_certmonger_disabled
Severity
Low
References
Updated

Remediation Templates

A Kubernetes Patch

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0

OS Build Blueprint

[customizations.services]
disabled = ["certmonger"]

An Ansible Snippet

- name: Block Disable service certmonger
  block:
  - name: Disable service certmonger
    block:

    - name: Disable service certmonger

A Shell Script

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'certmonger.service'
"$SYSTEMCTL_EXEC" disable 'certmonger.service'
"$SYSTEMCTL_EXEC" mask 'certmonger.service'

A Puppet Snippet

include disable_certmonger
class disable_certmonger {
  service {'certmonger':
    enable => false,
    ensure => 'stopped',
  }
}