documentation_complete: true

title: 'Enable Smart Card Login'

description: |-
    To enable smart card authentication, consult the documentation at:
    <ul>
    <li><b><weblink-macro link="https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Smart_Cards/enabling-smart-card-login.html" /></b></li>
    </ul>
    For guidance on enabling SSH to authenticate against a Common Access Card (CAC), consult documentation at:
    <ul>
    <li><b><weblink-macro link="https://access.redhat.com/solutions/82273" /></b></li>
    </ul>

rationale: |-
    Smart card login provides two-factor authentication stronger than
    that provided by a username and password combination. Smart cards leverage PKI
    (public key infrastructure) in order to provide and verify credentials.

severity: medium

identifiers:
    cce: 27440-7

references:
    disa: 765,766,767,768,771,772,884
    pcidss: Req-8.3
    srg: SRG-OS-000105
    stigid: RHEL-06-000349

ocil_clause: 'non-exempt accounts are not using CAC authentication'

ocil: "Interview the SA to determine if all accounts not exempted by policy are using\nCAC authentication. For DoD systems, the following systems and accounts are\nexempt from using smart card (CAC) authentication:\n<ul>\n<li>SIPRNET systems</li> \n<li>Standalone systems</li>\n<li>Application accounts</li>\n<li>Temporary employee accounts, such as students or interns, who cannot easily receive a CAC or PIV</li>\n<li>Operational tactical locations that are not collocated with RAPIDS workstations to issue CAC or ALT</li>\n<li>Test systems, such as those with an Interim Approval to Test (IATT) and use a separate VPN, firewall, or security measure preventing access to network and system components from outside the protection boundary documented in the IATT.</li>\n</ul>"
