Detections
Analytics

1.26 APPL-14-000120

Information

The macOS system must configure SSHD Channel Timeout to 900.

GROUP ID: V-259446RULE ID: SV-259446r970703

If SSHD is enabled it must be configured with session Channel Timeout set to 900.

This will set the time out when the session is inactive.

Note: /etc/ssh/sshd_config will be automatically modified to its original state following any update or major upgrade to the operating system.

Satisfies: SRG-OS-000163-GPOS-00072,SRG-OS-000279-GPOS-00109

Solution

Configure the macOS system to set the SSHD Channel Timeout to 900 with the following command:

include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/sshd_config | /usr/bin/tr -d '*')

if [[ -z $include_dir ]]; then/usr/bin/sed -i.bk "1s/.*/Include /etc/ssh/sshd_config.d/*/" /etc/ssh/sshd_configfi

/usr/bin/grep -qxF 'channeltimeout session: =900' "${include_dir}01-mscp-sshd.conf" 2>/dev/null || echo "channeltimeout session: =900" >> "${include_dir}01-mscp-sshd.conf"

for file in $(ls ${include_dir}); doif [[ "$file" == "100-macos.conf" ]]; thencontinuefiif [[ "$file" == "01-mscp-sshd.conf" ]]; thenbreakfi/bin/mv ${include_dir}${file} ${include_dir}20-${file}done

See Also

https://workbench.cisecurity.org/benchmarks/24070

Item Details

Category: ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-12, 800-53|SC-10, CAT|II, CCI|CCI-001133, CCI|CCI-002361, Rule-ID|SV-259446r970703_rule, STIG-ID|APPL-14-000120, Vuln-ID|V-259446

Plugin: Unix

Control ID: 04c696046ef27278585a0afad304085a022ca68300c9c8a8682e4274b1f0709a