documentation_complete: true

prodtype: rhel7

title: 'Configure PAM in SSSD Services'

description: |-
    SSSD should be configured to run SSSD <tt>pam</tt> services.
    To configure SSSD to known SSH hosts, add <tt>pam</tt>
    to <tt>services</tt> under the <tt>[sssd]</tt> section in
    <tt>/etc/sssd/sssd.conf</tt>. For example:
    <pre>[sssd]
    services = sudo, autofs, pam
    </pre>

rationale: |-
    Using an authentication device, such as a CAC or token that is separate from
    the information system, ensures that even if the information system is
    compromised, that compromise will not affect credentials stored on the
    authentication device.

severity: medium

identifiers:
    cce@rhel7: 80437-7

references:
    disa: 1948,1953,1954
    nist: IA-2(11)
    srg: SRG-OS-000375-GPOS-00160,SRG-OS-000375-GPOS-00161,SRG-OS-000375-GPOS-00162
    stigid@rhel7: "041002"

ocil_clause: 'it does not exist or ''pam'' is not added to the ''services'' option under the ''sssd'' section'

ocil: |-
    To verify that SSSD is configured for PAM services, run the following command:
    <pre>$ sudo grep services /etc/sssd/sssd.conf</pre>
    If configured properly, output should be similar to
    <pre>services = pam</pre>
