mediumaccess-controlverified ✓

Configure the PAM PKCS#11 module for smart-card authentication

pam-pkcs11-configured · UBUNTU ≥ 22 · 1 impl

Description

The pam_pkcs11.so module must be enabled in /etc/pam.d/common-auth so that PKCS#11 smart-card (PIV/CAC) credentials are accepted during authentication.

Rationale

Installing the PKCS#11 PAM module is not sufficient; it must be wired into the authentication stack (common-auth) for smart-card multifactor authentication to actually take effect. An absent or commented pam_pkcs11.so line means the system silently falls back to single-factor password authentication.

Check → Remediate

Checkcommand

grep -qE '^[[:space:]]*auth[[:space:]].*pam_pkcs11\.so' /etc/pam.d/common-auth 2>/dev/null

expected_exit:: 0

Remediatemanual

note:: Enable pam_pkcs11 in the authentication stack, e.g. add 'auth [success=2 default=ignore] pam_pkcs11.so' to /etc/pam.d/common-auth (managed via pam-auth-update).

Framework references

STIG

V-270721 / UBTU-24-400020

NIST 800-53

IA-2(1)IA-2(2)

Live verification

ubuntu24:check

#pkcs11#smartcard#pam#mfa#piv#stig