documentation_complete: true

# new major OS versions will most likely not be applicable because of the
# kerberos version higher than 1.17-18

title: 'Disable Kerberos by removing host keytab'

description: |-
    Kerberos may rely on key distribution functions unapproved by Common Criteria.
    To prevent using Kerberos by system daemons, remove the Kerberos keytab files, especially
    <tt>/etc/krb5.keytab</tt>.

rationale: |-
    Some key derivation functions (KDF) in Kerberos are not FIPS-compatible

severity: medium

identifiers:
    cce@rhel8: CCE-82175-1
    cce@rhel9: CCE-84221-1
    cce@rhel10: CCE-90440-9

references:
    srg: SRG-OS-000120-GPOS-00061
    stigid@ol8: OL08-00-010161

platforms:
    - krb5_server_older_than_1_17-18 and krb5_workstation_older_than_1_17-18

ocil_clause: 'a keytab file is present on the system'

ocil: |-
    Run the following command to see if there are some keytabs
    that would potentially allow the use of Kerberos by system daemons.
    <pre>$ ls -la /etc/*.keytab</pre>
    The expected result is
    <pre>ls: cannot access '/etc/*.keytab': No such file or directory</pre>

fixtext: |-
    Configure {{{ full_name }}} to prevent system daemons from using Kerberos for authentication.

    Remove any files with the .keytab extension from the operating system.
    rm -f /etc/*.keytab
