<def-group oval_version="5.11">
  <definition class="compliance" id="sssd_ssh_known_hosts_timeout" version="1">
    {{{ oval_metadata("SSSD should be configured to expire keys from known SSH hosts after 1 day.", rule_title=rule_title) }}}
    <criteria operator="OR">
      <criterion comment="Check ssh_known_hosts_timeout in /etc/sssd/sssd.conf"
      test_ref="test_sssd_ssh_known_hosts_timeout" />
    </criteria>
  </definition>

  <ind:textfilecontent54_test check="all" check_existence="all_exist"
  comment="tests the value of ssh_known_hosts_timeout setting in the /etc/sssd/sssd.conf file"
  id="test_sssd_ssh_known_hosts_timeout" version="1">
    <ind:object object_ref="obj_sssd_ssh_known_hosts_timeout" />
    <ind:state state_ref="state_sssd_ssh_known_hosts_timeout" />
  </ind:textfilecontent54_test>
  <ind:textfilecontent54_object id="obj_sssd_ssh_known_hosts_timeout" version="1">
    <ind:filepath>/etc/sssd/sssd.conf</ind:filepath>
    <ind:pattern operation="pattern match">^[\s]*\[ssh](?:[^\n\[]*\n+)+?[\s]*ssh_known_hosts_timeout[\s]*=[\s]*(\d+)$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>

  <ind:textfilecontent54_state comment="value of ssh_known_hosts_timeout setting"
  id="state_sssd_ssh_known_hosts_timeout" version="1">
    <ind:subexpression datatype="int" operation="less than or equal" var_check="all"
    var_ref="var_sssd_ssh_known_hosts_timeout" />
  </ind:textfilecontent54_state>

  <external_variable comment="var_sssd_ssh_known_hosts_timeout value" datatype="int"
  id="var_sssd_ssh_known_hosts_timeout" version="1" />

</def-group>
