OL 8 must not have the "gssproxy" package installed if not required for operational support.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-248904 | OL08-00-040370 | SV-248904r1069143_rule | CCI-000366 | medium |
| Description | ||||
| Verify the operating system is configured to disable nonessential capabilities. The most secure way of ensuring a nonessential capability is disabled is to not have the capability installed. When an application uses Generic Security Services API (GSSAPI), typically it will have direct access to its security credentials, and all cryptographic operations are performed in the application's process. This is undesirable, but "gssproxy" can help in almost all use cases. It provides privilege separation to applications using the GSSAPI: The gssproxy daemon runs on the system, holds the application's credentials, and performs operations on behalf of the application. | ||||
| STIG | Date | |||
| Oracle Linux 8 Security Technical Implementation Guide | 2025-05-13 | |||
Details
Check Text (C-248904r1069143_chk)
Note: For Oracle Linux systems, if there is an operational need for gssproxy to be installed, this requirement is Not Applicable.
Determine if the "gssproxy" package is installed with the following command:
$ sudo yum list installed gssproxy
If the "gssproxy" package is installed, this is a finding.
Fix Text (F-52292r1069142_fix)
Configure OL 8 to disable nonessential capabilities by removing the "gssproxy" package from the system with the following command:
$ sudo yum remove gssproxy