documentation_complete: true

prodtype: rhel6,rhel7

title: 'Configure SSSD to Expire SSH Known Hosts'

description: |-
    SSSD should be configured to expire keys from known SSH hosts after 1 day.
    To configure SSSD to known SSH hosts, set <tt>ssh_known_hosts_timeout</tt>
    to <tt>86400</tt> under the <tt>[ssh]</tt> section in
    <tt>/etc/sssd/sssd.conf</tt>. For example:
    <pre>[ssh]
    ssh_known_hosts_timeout = 86400
    </pre>

rationale: |-
    If cached authentication information is out-of-date, the validity of the
    authentication information may be questionable.

severity: medium

identifiers:
    cce@rhel6: RHEL6-CCE-TBD
    cce@rhel7: 80366-8

references:
    disa: 2007
    nist: IA-5(13)
    srg: SRG-OS-000383-GPOS-00166

ocil_clause: 'it does not exist or is not configured properly'

ocil: |-
    To verify that SSSD expires known SSH host keys, run the following command:
    <pre>$ sudo grep ssh_known_hosts_timeout /etc/sssd/sssd.conf</pre>
    If configured properly, output should be
    <pre>ssh_known_hosts_timeout = 86400</pre>
