Check: AOSX-09-000722
Apple OS X 10.9 Workstation STIG:
AOSX-09-000722
(in version v1 r2)
Title
The SSH daemon LoginGraceTime must be set correctly. (Cat II impact)
Discussion
SSH should be configured to log users out after a 15 minute interval of inactivity and to only wait 30 seconds before timing out login attempts. Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session or an incomplete login attempt will also free up resources committed by the managed network element.
Check Content
The SSH daemon LoginGraceTime must be set correctly. To check the amount of time that a user can login through SSH, run the following command: sudo grep ^LoginGraceTime /etc/sshd_config If the value is not set to '30' or less, this is a finding.
Fix Text
In order to make sure that LoginGraceTime is configured correctly, run the following command: sudo sed -i.bak 's/.*LoginGraceTime.*/LoginGraceTime 30/' /etc/sshd_config
Additional Identifiers
Rule ID: SV-72817r1_rule
Vulnerability ID: V-58387
Group Title:
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001133 |
The information system terminates the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity. |
Controls
Number | Title |
---|---|
SC-10 |
Network Disconnect |