← Back to Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide

V-260581

CAT III (Low)

Ubuntu 22.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day.

Rule ID

SV-260581r1155206_rule

STIG

Canonical Ubuntu 22.04 LTS Security Technical Implementation Guide

Version

V2R8

CCIs

CCI-002007

Discussion

If cached authentication information is out-of-date, the validity of the authentication information may be questionable.

Check Content

Verify that PAM prohibits the use of cached authentications after one day by using the following command: 
 
Note: If smart card authentication is not being used on the system, this requirement is not applicable.  
  
$ sudo grep -i '^\s*offline_credentials_expiration' /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf 
     /etc/sssd/sssd.conf:offline_credentials_expiration = 1 
 
If "offline_credentials_expiration" in "/etc/sssd/sssd.conf" or in a file with a name ending in .conf in the "/etc/sssd/conf.d/" directory, is not set to "1", is commented out, is missing, or conflicting results are returned, this is a finding.

Fix Text

Configure PAM to prohibit the use of cached authentications after one day.  
 
Add or modify the following line in the "/etc/sssd/sssd.conf" file, just below the line "[pam]": 
  
offline_credentials_expiration = 1 
  
Note: It is valid for this configuration to be in a file with a name that ends with ".conf" and does not begin with a "." in the "/etc/sssd/conf.d/" directory instead of the "/etc/sssd/sssd.conf" file.