Check: APPL-11-000052
Apple macOS 11 (Big Sur) STIG:
APPL-11-000052
(in versions v1 r4 through v1 r1)
Title
The macOS system must be configured with the SSH daemon ClientAliveCountMax option set to 0. (Cat II impact)
Discussion
If SSH is not being used, this is Not Applicable. The SSH daemon "ClientAliveCountMax" option must be set correctly. To verify the SSH idle timeout will occur when the "ClientAliveCountMax" is set, run the following command: /usr/bin/grep ^ClientAliveCountMax /etc/ssh/sshd_config If the setting is not "ClientAliveCountMax 0", this is a finding.
Check Content
The SSH daemon "ClientAliveCountMax" option must be set correctly. To verify the SSH idle timeout will occur when the "ClientAliveCountMax" is set, run the following command: /usr/bin/grep ^ClientAliveCountMax /etc/ssh/sshd_config If the setting is not "ClientAliveCountMax 0", this is a finding.
Fix Text
To ensure that the SSH idle timeout occurs precisely when the "ClientAliveCountMax" is set, run the following command: /usr/bin/sudo /usr/bin/sed -i.bak 's/.*ClientAliveCountMax.*/ClientAliveCountMax 0/' /etc/ssh/sshd_config
Additional Identifiers
Rule ID: SV-230765r599842_rule
Vulnerability ID: V-230765
Group Title: SRG-OS-000163-GPOS-00072
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001133 |
The information system terminates the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity. |
Controls
Number | Title |
---|---|
SC-10 |
Network Disconnect |