Host SSH daemon, if enabled, must set a timeout count on idle sessions

OrtaDüzey 1Otomatikvmware

Açıklama

Setting a timeout count on idle SSH sessions ensures that inactive sessions are automatically disconnected after a specified period. This period is calculated by multiplying the timeout count with the idle timeout interval. Automatic disconnection of idle sessions reduces the window of opportunity for unauthorized access. The audit reads /etc/ssh/sshd_config and requires ClientAliveCountMax to be set to a non-zero value; confirm it matches the approved value. Runs in the ESXi Shell (busybox sh) as root.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

f=/etc/ssh/sshd_config; [ -r "$f" ] || exit 1
v=$(awk 'tolower($1)=="clientalivecountmax" {print $2; exit}' "$f")
case "$v" in ''|*[!0-9]*) echo 'ClientAliveCountMax ${v:-not set}'; exit 1 ;; esac
[ "$v" -gt 0 ] && echo compliant || echo 'ClientAliveCountMax is 0'

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

To remediate this recommendation, set ClientAliveCountMax to the approved value, then restart SSH if enabled and test that inactive sessions are closed after the configured interval/count.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: vmwareesxiservices
Referans: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 6.5.5 Host SSH daemon, if enabled, must set a timeout count on idle sessions

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target vmware