Ensure sshd LoginGraceTime is configured

中级别 1自动化linux

说明

The LoginGraceTime parameter specifies the time allowed for successful authentication to the SSH server. The longer the Grace period is the more open unauthenticated connections can exist. Like other session controls in this section the Grace Period should be limited to appropriate organizational limits to ensure the service is available for needed access.

检查方式

审计方法: Shell 命令

shell

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; command -v sshd >/dev/null 2>&1 || { echo "step1: sshd not installed"; return 1; }; o=$(bash -c 'sshd -T | grep logingracetime' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'logingracetime 60' || { echo step1: missing 'logingracetime 60'; return 1; }; }; if alt0; then echo compliant; fi

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

Edit the /etc/ssh/sshd_config file to set the LoginGraceTime parameter to 60 seconds or less above any Include entry as follows: LoginGraceTime 60

属性

操作系统: rocky-9
标签: cis-convertedlinux
参考: CIS Rocky Linux 9 Benchmark v3.0.0 - 5.1.15

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target linux