Check: APPL-11-000053
Apple macOS 11 (Big Sur) STIG:
APPL-11-000053
(in versions v1 r4 through v1 r1)
Title
The macOS system must be configured with the SSH daemon LoginGraceTime set to 30 or less. (Cat II impact)
Discussion
If SSH is not being used, this is Not Applicable. The SSH daemon "LoginGraceTime" must be set correctly. To check the amount of time that a user can log on through SSH, run the following command: /usr/bin/grep ^LoginGraceTime /etc/ssh/sshd_config If the value is not set to "30" or less, this is a finding.
Check Content
The SSH daemon "LoginGraceTime" must be set correctly. To check the amount of time that a user can log on through SSH, run the following command: /usr/bin/grep ^LoginGraceTime /etc/ssh/sshd_config If the value is not set to "30" or less, this is a finding.
Fix Text
To ensure that "LoginGraceTime" is configured correctly, run the following command: /usr/bin/sudo /usr/bin/sed -i.bak 's/.*LoginGraceTime.*/LoginGraceTime 30/' /etc/ssh/sshd_config
Additional Identifiers
Rule ID: SV-230766r599842_rule
Vulnerability ID: V-230766
Group Title: SRG-OS-000163-GPOS-00072
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001133 |
The information system terminates the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity. |
Controls
Number | Title |
---|---|
SC-10 |
Network Disconnect |