Rules Related To 'krb5'

Component overview

Relevant packages:

Relevant groups:

Changelog:

No changes recorded.

Relevant rules:

Rule details

Disable Kerberos by removing host keytab

kerberos_disable_no_keytab

Description

Kerberos is not an approved key distribution method for Common Criteria. To prevent using Kerberos by system daemons, remove the Kerberos keytab files, especially /etc/krb5.keytab.

Rationale

The key derivation function (KDF) in Kerberos is not FIPS compatible.

Remove the Kerberos Server Package

package_krb5-server_removed

Description

The krb5-server package should be removed if not in use. Is this system the Kerberos server? If not, remove the package. The krb5-server package can be removed with the following command: 

$ sudo dnf remove krb5-server
The krb5-server RPM is not installed by default on a Amazon Linux 2023 system. It is needed only by the Kerberos servers, not by the clients which use Kerberos for authentication. If the system is not intended for use as a Kerberos Server it should be removed.

Rationale

Unnecessary packages should not be installed to decrease the attack surface of the system. While this software is clearly essential on an KDC server, it is not necessary on typical desktop or workstation systems.

Uninstall krb5-workstation Package

package_krb5-workstation_removed

Description

The krb5-workstation package can be removed with the following command: 

$ sudo dnf remove krb5-workstation

Rationale

Kerberos is a network authentication system. The krb5-workstation package contains the basic Kerberos programs (kinit, klist, kdestroy, kpasswd).