TMA-COS-5.1.16

Ensure SSH Idle Timeout Interval is configured

ThấpCấp 2Xem xét thủ côngcos

Mô tả

The two options ClientAliveInterval and ClientAliveCountMax control the timeout of ssh sessions. When the ClientAliveInterval variable is set, ssh sessions that have no activity for the specified length of time are terminated. When the ClientAliveCountMax variable is set, sshd will send client alive messages at every ClientAliveInterval interval. When the number of consecutive client alive messages are sent with no response from the client, the ssh session is terminated. For example, if the ClientAliveInterval is set to 15 seconds and the ClientAliveCountMax is set to 3, the client ssh session will be terminated after 45 seconds of idle time. Having no timeout value associated with a connection could allow an unauthorized user access to another user's ssh session (e.g. user walks away from their computer and doesn't lock the screen). Setting a timeout value at least reduces the risk o...

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

Run the following commands and verify ClientAliveInterval is between 1 and 300 and ClientAliveCountMax is 3 or less: # sshd -T | grep clientaliveinterval ClientAliveInterval 300 # sshd -T | grep clientalivecountmax ClientAliveCountMax 0

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

Edit the /etc/ssh/sshd_config file to set the parameters according to site policy: ClientAliveInterval 300 ClientAliveCountMax 0

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: container-optimized-oscosssh
Tham chiếu: CIS Google Container-Optimized OS Benchmark v1.2.0 - 5.1.16 Ensure SSH Idle Timeout Interval is configured