Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide

The Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide (V1 R7) has 195 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

195STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R7

CurrentPublished Wed Sep 30 2026

Ubuntu 24.04 LTS must map the authenticated identity to the user or group account for PKI-based authentication.

Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide

Assessment Title

Rule Text

Ubuntu 24.04 LTS must map the authenticated identity to the user or group account for PKI-based authentication.

Description

Discussion Text

Without mapping the certificate used to authenticate to the user account, the ability to determine the identity of the individual user or group will not be available for forensic analysis.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-270736

Rule

SV-270736r1066697_rule

Severity

high

Rule Version

UBTU-24-400370

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify that authenticated certificates are mapped to the appropriate user group in the "/etc/sssd/sssd.conf" file with the following command: 
 
$ grep -i ldap_user_certificate /etc/sssd/sssd.conf
ldap_user_certificate=userCertificate;binary

Implementation Procedure

Fix Text

Configure sssd to map authenticated certificates to the appropriate user group by adding the following line to the "/etc/sssd/sssd.conf" file:

ldap_user_certificate=userCertificate;binary

STIG check 90 of 195 in the Canonical Ubuntu 24.04 LTS STIG checklist

← Previous · V-270735Ubuntu 24.04 LTS, for PKI-based authentication, SSSD must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.Next · V-270737 →Ubuntu 24.04 LTS, for PKI-based authentication, Privileged Access Management (PAM) must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.