IA-02(02) Multi-factor Authentication to Non-privileged Accounts
All changes in this version
Title
Multi-factor Authentication to Non-privileged Accounts
Control
Implement multi-factor authentication for access to non-privileged accounts.
Discussion
Multi-factor authentication requires the use of two or more different factors to achieve authentication. The authentication factors are defined as follows: something you know (e.g., a personal identification number [PIN]), something you have (e.g., a physical authenticator such as a cryptographic private key), or something you are (e.g., a biometric). Multi-factor authentication solutions that feature physical authenticators include hardware authenticators that provide time-based or challenge-response outputs and smart cards such as the U.S. Government Personal Identity Verification card or the DoD Common Access Card. In addition to authenticating users at the system level, organizations may also employ authentication mechanisms at the application level, at their discretion, to provide increased information security. Regardless of the type of access (i.e., local, network, remote), non-privileged accounts are authenticated using multi-factor options appropriate for the level of risk. Organizations can provide additional security measures, such as additional or more rigorous authentication mechanisms, for specific types of access.
Related controls
ac-5
Assessment objective
IA-02(02) multi-factor authentication for access to non-privileged accounts is implemented.
STIG rules that implement this control 31
Apple macOS 15 (Sequoia) V1R8
- APPL-15-001150 CAT I The macOS system must disable password authentication for SSH.
- APPL-15-003020 CAT II The macOS system must enforce smart card authentication.
- APPL-15-003030 CAT II The macOS system must allow smart card authentication.
- APPL-15-003050 CAT II The macOS system must enforce multifactor authentication for login.
- APPL-15-003051 CAT II The macOS system must enforce multifactor authentication for the su command.
- APPL-15-003052 CAT II The macOS system must enforce multifactor authentication for privilege escalation through the sudo command.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-001150 CAT I The macOS system must disable password authentication for SSH.
- APPL-26-003020 CAT II The macOS system must enforce smart card authentication.
- APPL-26-003030 CAT II The macOS system must allow smart card authentication.
- APPL-26-003050 CAT II The macOS system must enforce multifactor authentication for login.
- APPL-26-003051 CAT II The macOS system must enforce multifactor authentication for the su command.
- APPL-26-003052 CAT II The macOS system must enforce multifactor authentication for privilege escalation through the sudo command.
Application Security and Development V6R5
- APSC-DV-001580 CAT II The application must use multifactor (e.g., CAC, Alt. Token) authentication for network access to non-privileged accounts.
- APSC-DV-001600 CAT II The application must use multifactor (e.g., CAC, Alt. Token) authentication for local access to nonprivileged accounts.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-254010 CAT II Ubuntu 22.04 LTS must have the "SSSD" package installed.
- UBTU-22-254015 CAT II Ubuntu 22.04 LTS must use the "SSSD" package for multifactor authentication services.
- UBTU-22-612010 CAT II Ubuntu 22.04 LTS must implement multifactor authentication for remote access to privileged accounts in such a way that one of the factors is provided by a device separate from the system gaining access.
- UBTU-22-612020 CAT II Ubuntu 22.04 LTS must implement smart card logins for multifactor authentication for local and network access to privileged and nonprivileged accounts.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-100650 CAT II Ubuntu 24.04 LTS must have the "SSSD" package installed.
- UBTU-24-100660 CAT II Ubuntu 24.04 LTS must use the "SSSD" package for multifactor authentication services.
- UBTU-24-400020 CAT II Ubuntu 24.04 LTS must implement smart card logins for multifactor authentication for local and network access to privileged and nonprivileged accounts.
- UBTU-24-400030 CAT II Ubuntu 24.04 LTS must implement smart card logins for multifactor authentication for local and network access to privileged and nonprivileged accounts over SSH.
Microsoft Windows Server 2025 V1R4
- WN25-SH-000030 CAT II Windows Server 2025 OpenSSH must accept public key authentication.
- WN25-SH-000040 CAT I Windows Server 2025 OpenSSH must not allow blank passwords.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-200621 CAT II RHEL 10 must use the common access card (CAC) smart card driver.
- RHEL-10-700600 CAT II RHEL 10 must be configured so that SSHD accepts public key authentication.
- RHEL-10-700610 CAT II RHEL 10 must be configured so that SSHD does not allow blank passwords.
- RHEL-10-701220 CAT II RHEL 10 must enable certificate-based smart card authentication.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-255035 CAT II RHEL 9 SSHD must accept public key authentication.
- RHEL-09-255040 CAT I RHEL 9 SSHD must not allow blank passwords.
- RHEL-09-611160 CAT II RHEL 9 must use the common access card (CAC) smart card driver.