documentation_complete: true


title: 'Configure session renegotiation for SSH client'

description: |-
    The <tt>RekeyLimit</tt> parameter specifies how often
    the session key is renegotiated, both in terms of
    amount of data that may be transmitted and the time
    elapsed. To decrease the default limits, put line
    <tt>RekeyLimit {{{ xccdf_value("var_ssh_client_rekey_limit_size") }}} {{{ xccdf_value("var_ssh_client_rekey_limit_time") }}}</tt> to file <tt>/etc/ssh/ssh_config.d/02-rekey-limit.conf</tt>.
    Make sure that there is no other <tt>RekeyLimit</tt> configuration preceding
    the <tt>include</tt> directive in the main config file
    <tt>/etc/ssh/ssh_config</tt>. Check also other files in
    <tt>/etc/ssh/ssh_config.d</tt> directory. Files are processed according to
    lexicographical order of file names. Make sure that there is no file
    processed before <tt>02-rekey-limit.conf</tt> containing definition of
    <tt>RekeyLimit</tt>.

rationale: |-
    By decreasing the limit based on the amount of data and enabling
    time-based limit, effects of potential attacks against
    encryption keys are limited.

severity: medium

identifiers:
    cce@rhel8: CCE-82880-6
    cce@rhel9: CCE-87522-9
    cce@rhel10: CCE-89510-2

references:
    ospp: FCS_SSH_EXT.1.8
    srg: SRG-OS-000423-GPOS-00187,SRG-OS-000033-GPOS-00014,SRG-OS-000424-GPOS-00188

ocil_clause: 'it is commented out or is not set'

ocil: |-
    To check if RekeyLimit is set correctly, run the following command:
    <pre>$ sudo grep RekeyLimit /etc/ssh/ssh_config.d/*.conf</pre>
    If configured properly, output should be
    <pre>/etc/ssh/ssh_config.d/02-rekey-limit.conf:
    RekeyLimit {{{ xccdf_value("var_ssh_client_rekey_limit_size") }}} {{{ xccdf_value("var_ssh_client_rekey_limit_time") }}}</pre>
    Check also the main configuration file with the following command:
    <pre>$ sudo grep RekeyLimit /etc/ssh/ssh_config</pre>
    The command should not return any output.

fixtext: |-
    Configure {{{ full_name }}} to force a frequent session key renegotiation for SSH connections to the server by adding or modifying the following line in the "/etc/ssh/sshd_config" file:

    RekeyLimit {{{ xccdf_value("var_ssh_client_rekey_limit_size") }}} {{{ xccdf_value("var_ssh_client_rekey_limit_time") }}}

    Restart the SSH daemon for the settings to take effect.

    $ sudo systemctl restart sshd.service

