documentation_complete: true


title: 'Configure SSSD''s Memory Cache to Expire'

description: |-
    SSSD's memory cache should be configured to set to expire records after
    <tt>{{{ xccdf_value("var_sssd_memcache_timeout") }}}</tt> seconds.
    To configure SSSD to expire memory cache, set <tt>memcache_timeout</tt> to
    <tt>{{{ xccdf_value("var_sssd_memcache_timeout") }}}</tt> under the
    <tt>[nss]</tt> section in <tt>/etc/sssd/sssd.conf</tt>.

    For example:
    <pre>[nss]
    memcache_timeout = {{{ xccdf_value("var_sssd_memcache_timeout") }}}
    </pre>

rationale: |-
    If cached authentication information is out-of-date, the validity of the
    authentication information may be questionable.

severity: medium

identifiers:
    cce@rhel8: CCE-80910-3
    cce@sle12: CCE-83040-6
    cce@sle15: CCE-83295-6
    cce@slmicro5: CCE-93718-5
    cce@slmicro6: CCE-94723-4

references:
    cis-csc: 1,12,15,16,5
    cobit5: DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.03,DSS06.10
    isa-62443-2009: 4.3.3.2.2,4.3.3.5.1,4.3.3.5.2,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.2,4.3.3.7.4
    isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.7,SR 1.8,SR 1.9,SR 2.1'
    iso27001-2013: A.18.1.4,A.7.1.1,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.2,A.9.4.3
    nist: CM-6(a),IA-5(13)
    nist-csf: PR.AC-1,PR.AC-6,PR.AC-7
    srg: SRG-OS-000383-GPOS-00166
    stigid@sle12: SLES-12-010670
    stigid@sle15: SLES-15-010490

ocil_clause: 'it does not exist or is not configured properly'

ocil: |-
    To verify that SSSD's in-memory cache expires after a day, run the following command:
    <pre>$ sudo grep memcache_timeout /etc/sssd/sssd.conf</pre>
    If configured properly, output should be <pre>memcache_timeout = {{{ xccdf_value("var_sssd_memcache_timeout") }}}</pre>.
