STIGQter: STIG Summary: Canonical Ubuntu 24.04 LTS Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 01 Jul 2026:

Ubuntu 24.04 LTS must be configured such that Pluggable Authentication Module (PAM) prohibits the use of cached authentications after one day.

DISA Rule

SV-270734r1155240_rule

Vulnerability Number

V-270734

Group Title

SRG-OS-000383-GPOS-00166

Rule Version

UBTU-24-400340

Severity

CAT III

CCI(s)

CCI-002007 - Prohibit the use of cached authenticators after an organization-defined time period.

Weight

Fix Recommendation

Configure PAM to prohibit the use of cached authentications after one day. Add or change the following line in "/etc/sssd/sssd.conf" just below the line "[pam]":

offline_credentials_expiration = 1

Note: It is valid for this configuration to be in a file with a name that ends with ".conf" and does not begin with a "." in the "/etc/sssd/conf.d/" directory instead of the "/etc/sssd/sssd.conf" file.

Check Contents

Note: If smart card authentication is not being used on the system, this requirement is not applicable.

Verify PAM prohibits the use of cached authentications after one day with the following command:

$ sudo grep offline_credentials_expiration /etc/sssd/sssd.conf /etc/sssd/conf.d/*.conf
offline_credentials_expiration = 1

If "offline_credentials_expiration" in "/etc/sssd/sssd.conf" or in a file with a name ending in .conf in the "/etc/sssd/conf.d/" directory, is not set to "1", is commented out, is missing, or conflicting results are returned, this is a finding.

Vulnerability Number

V-270734

Documentable

False

Rule Version

UBTU-24-400340

Severity Override Guidance

Check Content Reference

Target Key

5673