Detections
Analytics

5.2.16 Ensure SSH Idle Timeout Interval is configured - ClientAliveInterval

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The two options ClientAliveInterval and ClientAliveCountMax control the timeout of ssh sessions.

ClientAliveInterval sets a timeout interval in seconds after which if no data has been received from the client, sshd will send a message through the encrypted channel to request a response from the client. The default is 0, indicating that these messages will not be sent to the client.

ClientAliveCountMax sets the number of client alive messages which may be sent without sshd receiving any messages back from the client. If this threshold is reached while client alive messages are being sent, sshd will disconnect the client, terminating the session. The default value is 3.

The client alive messages are sent through the encrypted channel

Setting ClientAliveCountMax to 0 disables connection termination

Example: If the ClientAliveInterval is set to 15 seconds and the ClientAliveCountMax is set to 3, the client ssh session will be terminated after 45 seconds of idle time.

Rationale:

Having no timeout value associated with a connection could allow an unauthorized user access to another user's ssh session (e.g. user walks away from their computer and doesn't lock the screen). Setting a timeout value reduces this risk.

The recommended ClientAliveInterval setting is 300 seconds (5 minutes)

The recommended ClientAliveCountMax setting is 3

The ssh session would send three keep alive messages at 5 minute intervals. If no response is received after the third keep alive message, the ssh session would be terminated after 15 minutes.

Solution

Edit the /etc/ssh/sshd_config file to set the parameters according to site policy. This should include ClientAliveInterval between 1 and 300 and ClientAliveCountMax of 3 or less:

ClientAliveInterval 300

ClientAliveCountMax 3

Default Value:

ClientAliveInterval 0

ClientAliveCountMax 3

References:

https://man.openbsd.org/sshd_config

See Also

https://workbench.cisecurity.org/files/2948

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-12., CSCv7|16.11

Plugin: Unix

Control ID: a6dd9aa85baf8cf2721f9ef61089ffbfbe4c46d6cb68661e5261b057bee93aa8