NixOS must prohibit the use of cached authenticators after one day.

If cached authentication information is out-of-date, the validity of the authentication information may be questionable.

Verify NixOS, for PKI-based authentication, only caches authenticators for one day with the following command:

$ sudo grep expiration /etc/sssd/sssd.conf

offline_credentials_expiration = 1

If the offline_credentials_expiration is not set to "1" or is commented out, this is a finding.

Configure NixOS to prohibit the use of cached credentials older than one day.

Add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

Note: The entire sssd.conf must be entered in this option.

services.sssd.config = '' ... [pam] offline_credentials_expiration = 1 ... '';

Rebuild and switch to the new NixOS configuration: $ sudo nixos-rebuild switch