Host SSH daemon, if enabled, must set a timeout count on idle sessions

MediumLevel 1Automatedvmware

Description

Setting a timeout count on idle SSH sessions ensures that inactive sessions are automatically disconnected after a specified period. This period is calculated by multiplying the timeout count with the idle timeout interval. Automatic disconnection of idle sessions reduces the window of opportunity for unauthorized access. The audit reads /etc/ssh/sshd_config and requires ClientAliveCountMax to be set to a non-zero value; confirm it matches the approved value. Runs in the ESXi Shell (busybox sh) as root.

How it is checked

Audit method: Shell command

shell

f=/etc/ssh/sshd_config; [ -r "$f" ] || exit 1
v=$(awk 'tolower($1)=="clientalivecountmax" {print $2; exit}' "$f")
case "$v" in ''|*[!0-9]*) echo 'ClientAliveCountMax ${v:-not set}'; exit 1 ;; esac
[ "$v" -gt 0 ] && echo compliant || echo 'ClientAliveCountMax is 0'

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

To remediate this recommendation, set ClientAliveCountMax to the approved value, then restart SSH if enabled and test that inactive sessions are closed after the configured interval/count.

Properties

Operating systems: Any
Tags: vmwareesxiservices
Reference: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 6.5.5 Host SSH daemon, if enabled, must set a timeout count on idle sessions

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target vmware