documentation_complete: true

prodtype: rhel6,rhel7

title: 'Configure SSSD to Expire Offline Credentials'

description: |-
    SSSD should be configured to expire offline credentials after 1 day.
    To configure SSSD to expire offline credentials, set
    <tt>offline_credentials_expiration</tt> to <tt>1</tt> under the <tt>[pam]</tt>
    section in <tt>/etc/sssd/sssd.conf</tt>. For example:
    <pre>[pam]
    offline_credentials_expiration = 1
    </pre>

rationale: |-
    If cached authentication information is out-of-date, the validity of the
    authentication information may be questionable.

severity: medium

identifiers:
    cce@rhel6: RHEL6-CCE-TBD
    cce@rhel7: 80365-0

references:
    disa: 2007
    nist: IA-5(13)
    ospp@rhel7: FIA_AFL.1
    srg: SRG-OS-000383-GPOS-00166

ocil_clause: 'it does not exist or is not configured properly'

ocil: |-
    To verify that SSSD expires offline credentials, run the following command:
    <pre>$ sudo grep offline_credentials_expiration /etc/sssd/sssd.conf</pre>
    If configured properly, output should be
    <pre>offline_credentials_expiration = 1</pre>
