{"description": "The SSH server sends at most ClientAliveCountMax messages\nduring a SSH session and waits for a response from the SSH client.\nThe option ClientAliveInterval configures timeout after\neach ClientAliveCountMax message. If the SSH server does not\nreceive a response from the client, then the connection is considered unresponsive\nand terminated.\n\nTo ensure the SSH timeout occurs precisely when the\nClientAliveInterval is set, set the ClientAliveCountMax to\nvalue of 0 in\n\n\n/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf:", "rationale": "This ensures a user login will be terminated as soon as the ClientAliveInterval\nis reached.", "severity": "medium", "references": {"cis-csc": ["1", "12", "13", "14", "15", "16", "18", "3", "5", "7", "8"], "cjis": ["5.5.6"], "cobit5": ["APO13.01", "BAI03.01", "BAI03.02", "BAI03.03", "DSS01.03", "DSS03.05", "DSS05.04", "DSS05.05", "DSS05.07", "DSS05.10", "DSS06.03", "DSS06.10"], "cui": ["3.1.11"], "hipaa": ["164.308(a)(4)(i)", "164.308(b)(1)", "164.308(b)(3)", "164.310(b)", "164.312(e)(1)", "164.312(e)(2)(ii)"], "isa-62443-2009": ["4.3.3.2.2", "4.3.3.5.1", "4.3.3.5.2", "4.3.3.6.1", "4.3.3.6.2", "4.3.3.6.3", "4.3.3.6.4", "4.3.3.6.5", "4.3.3.6.6", "4.3.3.6.7", "4.3.3.6.8", "4.3.3.6.9", "4.3.3.7.2", "4.3.3.7.3", "4.3.3.7.4", "4.3.4.3.3"], "isa-62443-2013": ["SR 1.1", "SR 1.10", "SR 1.2", "SR 1.3", "SR 1.4", "SR 1.5", "SR 1.7", "SR 1.8", "SR 1.9", "SR 2.1", "SR 6.2"], "iso27001-2013": ["A.12.4.1", "A.12.4.3", "A.14.1.1", "A.14.2.1", "A.14.2.5", "A.18.1.4", "A.6.1.2", "A.6.1.5", "A.7.1.1", "A.9.1.2", "A.9.2.1", "A.9.2.2", "A.9.2.3", "A.9.2.4", "A.9.2.6", "A.9.3.1", "A.9.4.1", "A.9.4.2", "A.9.4.3", "A.9.4.4", "A.9.4.5"], "nerc-cip": ["CIP-004-6 R2.2.3", "CIP-007-3 R5.1", "CIP-007-3 R5.2", "CIP-007-3 R5.3.1", "CIP-007-3 R5.3.2", "CIP-007-3 R5.3.3"], "nist": ["AC-2(5)", "AC-12", "AC-17(a)", "SC-10", "CM-6(a)"], "nist-csf": ["DE.CM-1", "DE.CM-3", "PR.AC-1", "PR.AC-4", "PR.AC-6", "PR.AC-7", "PR.IP-2"], "pcidss": ["Req-8.1.8"], "srg": ["SRG-OS-000126-GPOS-00066", "SRG-OS-000163-GPOS-00072", "SRG-OS-000279-GPOS-00109"]}, "control_references": {}, "components": [], "identifiers": {}, "ocil_clause": "it is commented out or not configured properly", "ocil": "To ensure ClientAliveInterval is set correctly, run the following command:\n\n
$ sudo grep ClientAliveCountMax /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf
\n\nIf properly configured, the output should be:\n
ClientAliveCountMax 0
\n\nIn this case, the SSH timeout occurs precisely when\nthe ClientAliveInterval is set.", "oval_external_content": null, "fixtext": "", "checktext": "", "vuldiscussion": "", "srg_requirement": "", "warnings": [], "conflicts": [], "requires": ["sshd_set_idle_timeout"], "policy_specific_content": {"stig": {"srg_requirement": "Ubuntu 22.04 Must Terminate All Network Connections Associated With A Communications Session At The End Of The Session, Or As Follows: For In-Band Management Sessions (Privileged Sessions), The Session Must Be Terminated After 10 Minutes Of Inactivity; And For User Sessions (Non-Privileged Session), The Session Must Be Terminated After 15 Minutes Of Inactivity, Except To Fulfill Documented And Validated Mission Requirements.", "vuldiscussion": "This ensures a user login will be terminated as soon as the \"ClientAliveInterval\"\nis reached.", "checktext": "To ensure \"ClientAliveInterval\" is set correctly, run the following command:\n\n $ sudo grep ClientAliveCountMax /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf\n\nIf properly configured, the output should be:\n ClientAliveCountMax 0\n\nIn this case, the SSH idle timeout occurs precisely when\nthe \"ClientAliveInterval\" is set.\n\nIf it is commented out or not configured properly, then this is a finding."}}, "platform": null, "platforms": [], "sce_metadata": {}, "inherited_platforms": ["system_with_kernel"], "cpe_platform_names": [], "inherited_cpe_platform_names": ["system_with_kernel"], "bash_conditional": null, "fixes": {}, "title": "Set SSH Client Alive Count Max to zero", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/services/ssh/ssh_server/sshd_set_keepalive_0/rule.yml", "template": {"name": "sshd_lineinfile", "vars": {"parameter": "ClientAliveCountMax", "value": "0", "datatype": "int"}, "backends": {"kubernetes": "off"}}}