Red Hat Enterprise Linux 8 Security Technical Implementation Guide

The Red Hat Enterprise Linux 8 Security Technical Implementation Guide (V2 R9) has 371 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

371STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R9

CurrentPublished Wed Sep 30 2026

RHEL 8, for certificate-based authentication, must enforce authorized access to the corresponding private key.

Red Hat Enterprise Linux 8 Security Technical Implementation Guide

Assessment Title

Rule Text

RHEL 8, for certificate-based authentication, must enforce authorized access to the corresponding private key.

Description

Discussion Text

If an unauthorized user obtains access to a private key without a passcode, that user would have unauthorized access to any system where the associated public key has been installed.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-230230

Rule

SV-230230r1069287_rule

Severity

medium

Rule Version

RHEL-08-010100

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify the SSH private key files have a passcode.

For each private key stored on the system, use the following command:

$ sudo ssh-keygen -y -f /path/to/file
Enter passphrase:

If the contents of the key are displayed, this is a finding.

Implementation Procedure

Fix Text

Create a new private and public key pair that utilizes a passcode with the following command:

$ sudo ssh-keygen -p -f /path/to/file

STIG check 10 of 371 in the Red Hat Enterprise Linux 8 STIG checklist

← Previous · V-230229RHEL 8, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor.Next · V-230231 →RHEL 8 must encrypt all stored passwords with a FIPS 140-2 approved cryptographic hashing algorithm.