documentation_complete: true

prodtype: rhel6,rhel7

title: 'Configure SSSD''s Memory Cache to Expire'

description: |-
    SSSD's memory cache should be configured to set to expire records after 1 day.
    To configure SSSD to expire memory cache, set <tt>memcache_timeout</tt> to
    <tt>86400</tt> under the <tt>[nss]</tt> section in <tt>/etc/sssd/sssd.conf</tt>.
    For example:
    <pre>[nss]
    memcache_timeout = 86400
    </pre>

rationale: |-
    If cached authentication information is out-of-date, the validity of the
    authentication information may be questionable.

severity: medium

identifiers:
    cce@rhel6: RHEL6-CCE-TBD
    cce@rhel7: 80364-3

references:
    disa: 2007
    disa@rhel6: 2007
    nist: IA-5(13)
    nist@rhel6: IA-5(10)
    srg: SRG-OS-000383-GPOS-00166

ocil_clause: 'it does not exist or is not configured properly'

ocil: |-
    To verify that SSSD's in-memory cache expires after a day, run the following command:
    <pre>$ sudo grep memcache_timeout /etc/sssd/sssd.conf</pre>
    If configured properly, output should be <pre>memcache_timeout = 86400</pre>.
