Title

If Network Security Services (NSS) is being used by the SUSE operating system it must prohibit the use of cached authentications after one day. (Cat II impact)

Discussion

If cached authentication information is out of date, the validity of the authentication information may be questionable.

Check Content

If NSS is not used on the operating system, this is Not Applicable. If NSS is used by the SUSE operating system, verify it prohibits the use of cached authentications after one day. Check that cached authentications cannot be used after one day with the following command: # sudo grep -i "memcache_timeout" /etc/sssd/sssd.conf memcache_timeout = 86400 If "memcache_timeout" has a value greater than "86400", or is missing, this is a finding.

Fix Text

Configure NSS, if used by the SUSE operating system, to prohibit the use of cached authentications after one day. Add or change the following line in "/etc/sssd/sssd.conf" just below the line "[nss]": memcache_timeout = 86400

Additional Identifiers

Rule ID: SV-217166r958828_rule

Vulnerability ID: V-217166

Group Title: SRG-OS-000383-GPOS-00166

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.