The macOS system must be configured with the SSH daemon ClientAliveCountMax option set to 0.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-230765 | APPL-11-000052 | SV-230765r599842_rule | Medium |
| Description |
|---|
| If SSH is not being used, this is Not Applicable. The SSH daemon "ClientAliveCountMax" option must be set correctly. To verify the SSH idle timeout will occur when the "ClientAliveCountMax" is set, run the following command: /usr/bin/grep ^ClientAliveCountMax /etc/ssh/sshd_config If the setting is not "ClientAliveCountMax 0", this is a finding. |
| STIG | Date |
|---|---|
| Apple macOS 11 (Big Sur) Security Technical Implementation Guide | 2021-03-29 |
Details
| Check Text ( C-33710r607182_chk ) |
|---|
| The SSH daemon "ClientAliveCountMax" option must be set correctly. To verify the SSH idle timeout will occur when the "ClientAliveCountMax" is set, run the following command: /usr/bin/grep ^ClientAliveCountMax /etc/ssh/sshd_config If the setting is not "ClientAliveCountMax 0", this is a finding. |
| Fix Text (F-33683r607183_fix) |
|---|
| To ensure that the SSH idle timeout occurs precisely when the "ClientAliveCountMax" is set, run the following command: /usr/bin/sudo /usr/bin/sed -i.bak 's/.*ClientAliveCountMax.*/ClientAliveCountMax 0/' /etc/ssh/sshd_config |