Detections
Analytics

1.302 ALMA-09-038630

Information

AlmaLinux OS 9 must prohibit the use of cached authenticators after one day.

GROUP ID: V-269409
RULE ID: SV-269409r1050292

Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. If the information system or application allows the user to consecutively reuse their password when that password has exceeded its defined lifetime, the end result is a password that is not changed as per policy requirements.

If cached authentication information is out-of-date, the validity of the authentication information may be questionable.

Solution

Configure the SSSD to prohibit the use of cached authentications after one day.

Add/modify the following line in "/etc/sssd/sssd.conf" (or a conf file in /etc/sssd/conf.d/) just below the line [pam]:

offline_credentials_expiration = 1

See Also

https://workbench.cisecurity.org/benchmarks/27039

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(13), CCI|CCI-002007, Rule-ID|SV-269409r1050292_rule, STIG-ID|ALMA-09-038630, Vuln-ID|V-269409

Plugin: Unix

Control ID: 06932ca42e0e83d08878813e110919ef42a6508b4087969da57adea1fad7a1de