Check: PHTN-67-000039
VMware vSphere 6.7 Photon OS STIG:
PHTN-67-000039
(in versions v1 r6 through v1 r1)
Title
The Photon operating system must configure sshd to disconnect idle SSH sessions. (Cat II impact)
Discussion
Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended.
Check Content
At the command line, execute the following command: # sshd -T|&grep -i ClientAliveCountMax Expected result: ClientAliveCountMax 0 If the output does not match the expected result, this is a finding.
Fix Text
Open /etc/ssh/sshd_config with a text editor. Ensure that the "ClientAliveCountMax" line is uncommented and set to the following: ClientAliveCountMax 0 At the command line, execute the following command: # service sshd reload
Additional Identifiers
Rule ID: SV-239111r675141_rule
Vulnerability ID: V-239111
Group Title: SRG-OS-000163-GPOS-00072
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001133 |
The information system terminates the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity. |
Controls
Number | Title |
---|---|
SC-10 |
Network Disconnect |