SV-260581r1155206: Ubuntu 22.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day. | Canonical Ubuntu 22.04 LTS STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

Ubuntu 22.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day.

Description

Discussion Text

If cached authentication information is out-of-date, the validity of the authentication information may be questionable.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-002007

References

DPMS Target Canonical Ubuntu 22.04 LTS DISA DPMS Target Canonical Ubuntu 22.04 LTS 5594

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.ubuntu2204os:def:260581
# Ubuntu 22.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# /etc/sssd/sssd.conf:offline_credentials_expiration = 1
# textfilecontent54_object (textfilecontent54_test)
test_1() {
  ( [ "$(sed -En 's/^\s*offline_credentials_expiration\s*=\s*(\d*)\s*(?:#.*)?$/\1/p' '/etc/sssd/sssd.conf')" -eq 1 ] ) || ( [ "$(grep -rhP --include='*.conf' '^\s*offline_credentials_expiration\s*=\s*(\d*)\s*(?:#.*)?$' '/etc/sssd/conf.d' | sed -En 's/^\s*offline_credentials_expiration\s*=\s*(\d*)\s*(?:#.*)?$/\1/p')" -eq 1 ] )
}

if test_1; then
  echo "PASS"
else
  echo "FAIL"
fi

Remediation

Configure PAM to prohibit the use of cached authentications after one day.  
 
Add or modify the following line in the "/etc/sssd/sssd.conf" file, just below the line "[pam]": 
  
offline_credentials_expiration = 1 
  
Note: It is valid for this configuration to be in a file with a name that ends with ".conf" and does not begin with a "." in the "/etc/sssd/conf.d/" directory instead of the "/etc/sssd/sssd.conf" file.