Check: APPL-11-000051
Apple macOS 11 (Big Sur) STIG:
APPL-11-000051
(in versions v1 r4 through v1 r1)
Title
The macOS system must be configured with the SSH daemon ClientAliveInterval option set to 900 or less. (Cat II impact)
Discussion
If SSH is not being used, this is Not Applicable. The SSH daemon "ClientAliveInterval" option must be set correctly. To check the idle timeout setting for SSH sessions, run the following: /usr/bin/grep ^ClientAliveInterval /etc/ssh/sshd_config If the setting is not "900" or less, this is a finding.
Check Content
The SSH daemon "ClientAliveInterval" option must be set correctly. To check the idle timeout setting for SSH sessions, run the following: /usr/bin/grep ^ClientAliveInterval /etc/ssh/sshd_config If the setting is not "900" or less, this is a finding.
Fix Text
To ensure that "ClientAliveInterval" is set correctly, run the following command: /usr/bin/sudo /usr/bin/sed -i.bak 's/.*ClientAliveInterval.*/ClientAliveInterval 900/' /etc/ssh/sshd_config
Additional Identifiers
Rule ID: SV-230764r599842_rule
Vulnerability ID: V-230764
Group Title: SRG-OS-000163-GPOS-00072
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001133 |
The information system terminates the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity. |
Controls
Number | Title |
---|---|
SC-10 |
Network Disconnect |