openstack/ansible-hardening
Code Issues Proposed changes
ansible-hardening/doc/metadata/rhel7/RHEL-07-010401.rst
Major Hayden 8fe505e628 Expire cached sssd authenticators [+Docs] 
This patch provides tasks and docs to implement the following STIGs:

  - RHEL-07-010400
  - RHEL-07-010401
  - RHEL-07-010402

The tasks will not run if the sssd configuration file is not present.

Implements: blueprint security-rhel7-stig
Change-Id: Iddf850b8ccd72871beba4644b765e33e6d3c968b
2016-11-30 15:49:54 +00:00

369 B
Raw Blame History

---id: RHEL-07-010401 status: implemented tag: auth ---

The offline_credentials_expiration configuration is set to 1 in /etc/sssd/sssd.conf, which causes credentials to expire after one day. Deployers can adjust this expiration time by setting the following Ansible variable:

security_pam_offline_credentials_expiration_days: 1