Disable Kerberos by removing host keytab
An XCCDF Rule
Description
Kerberos is not an approved key distribution method for
Common Criteria. To prevent using Kerberos by system daemons,
remove the Kerberos keytab files, especially
/etc/krb5.keytab.
Rationale
The key derivation function (KDF) in Kerberos is not FIPS compatible.
- ID
- xccdf_org.ssgproject.content_rule_kerberos_disable_no_keytab
- Severity
- Medium
- References
- Updated
Remediation - Ansible
- name: Find keytab files
find:
paths: /etc/
patterns: '*.keytab'
register: keytab_files
when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
rm -f /etc/*.keytab
else