mediumaccess-controlverified ✓rollback-safe

Install the PAM PKCS#11 smart-card module

pam-pkcs11-installed · UBUNTU ≥ 22 · 1 impl

Description

The libpam-pkcs11 package (the PAM module for PKCS#11 smart cards) must be installed so that PIV/CAC smart-card credentials can be used for multifactor authentication through PAM.

Rationale

PIV/CAC-based multifactor authentication depends on the PKCS#11 PAM module to bridge smart-card credentials into the authentication stack. Without it, the system cannot accept smart-card logons and falls back to single-factor password authentication for privileged and remote access.

Check → Remediate

Checkcommand

dpkg -l 2>/dev/null | grep -qE '^ii[[:space:]]+libpam-pkcs11([[:space:]]|:)'

expected_exit:: 0

Remediateapt_present

name:: libpam-pkcs11

Framework references

STIG

V-270673 / UBTU-24-100910V-260573 / UBTU-22-612010

NIST 800-53

IA-2(1)IA-2(2)IA-8

Live verification

ubuntu22:checkubuntu24:check

#pkcs11#smartcard#pam#mfa#piv#stig