Check: APPL-14-000120
Apple macOS 14 (Sonoma) STIG:
APPL-14-000120
(in versions v1 r2 through v1 r1)
Title
The macOS system must configure SSHD Channel Timeout to 900. (Cat II impact)
Discussion
If SSHD is enabled it must be configured with session Channel Timeout set to 900. This will set the time out when the session is inactive. Note: /etc/ssh/sshd_config will be automatically modified to its original state following any update or major upgrade to the operating system. Satisfies: SRG-OS-000163-GPOS-00072,SRG-OS-000279-GPOS-00109
Check Content
Verify the macOS system is configured to set the SSHD Channel Timeout to 900 with the following command: /usr/sbin/sshd -G | /usr/bin/awk -F "=" '/channeltimeout session:*/{print $2}' If the result is not "900", this is a finding.
Fix Text
Configure the macOS system to set the SSHD Channel Timeout to 900 with the following command: include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/sshd_config | /usr/bin/tr -d '*') if [[ -z $include_dir ]]; then /usr/bin/sed -i.bk "1s/.*/Include \/etc\/ssh\/sshd_config.d\/\*/" /etc/ssh/sshd_config fi /usr/bin/grep -qxF 'channeltimeout session:*=900' "${include_dir}01-mscp-sshd.conf" 2>/dev/null || echo "channeltimeout session:*=900" >> "${include_dir}01-mscp-sshd.conf" for file in $(ls ${include_dir}); do if [[ "$file" == "100-macos.conf" ]]; then continue fi if [[ "$file" == "01-mscp-sshd.conf" ]]; then break fi /bin/mv ${include_dir}${file} ${include_dir}20-${file} done
Additional Identifiers
Rule ID: SV-259446r940960_rule
Vulnerability ID: V-259446
Group Title: SRG-OS-000163-GPOS-00072
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-001133 |
The information system terminates the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity. |
| CCI-002361 |
The information system automatically terminates a user session after organization-defined conditions or trigger events requiring session disconnect. |