Host SSH daemon, if enabled, must set a timeout count on idle sessions

보통레벨 1자동vmware

설명

Setting a timeout count on idle SSH sessions ensures that inactive sessions are automatically disconnected after a specified period. This period is calculated by multiplying the timeout count with the idle timeout interval. Automatic disconnection of idle sessions reduces the window of opportunity for unauthorized access. The audit reads /etc/ssh/sshd_config and requires ClientAliveCountMax to be set to a non-zero value; confirm it matches the approved value. Runs in the ESXi Shell (busybox sh) as root.

점검 방법

감사 방식: 셸 명령

shell

f=/etc/ssh/sshd_config; [ -r "$f" ] || exit 1
v=$(awk 'tolower($1)=="clientalivecountmax" {print $2; exit}' "$f")
case "$v" in ''|*[!0-9]*) echo 'ClientAliveCountMax ${v:-not set}'; exit 1 ;; esac
[ "$v" -gt 0 ] && echo compliant || echo 'ClientAliveCountMax is 0'

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

To remediate this recommendation, set ClientAliveCountMax to the approved value, then restart SSH if enabled and test that inactive sessions are closed after the configured interval/count.

속성

운영 체제: 모두
태그: vmwareesxiservices
참고 자료: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 6.5.5 Host SSH daemon, if enabled, must set a timeout count on idle sessions

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target vmware