SLEM 5 must configure the Linux Pluggable Authentication Modules (PAM) to prohibit the use of cached offline authentications after one day.

If cached authentication information is out of date, the validity of the authentication information may be questionable.

Verify that SLEM 5 PAM prohibits the use of cached off line authentications after one day with the following command:

Note: If SSSD is not being used on the operating system, this is not applicable.

     > sudo grep "offline_credentials_expiration" /etc/sssd/sssd.conf
     offline_credentials_expiration = 1

If "offline_credentials_expiration" is not set to a value of "1", the line is commented out, or the line is missing, this is a finding.

Configure SLEM 5 PAM to prohibit the use of cached authentications after one day.

Add or modify the following line in the "/etc/sssd/sssd.conf" file, below the line "[pam]":

offline_credentials_expiration = 1