Detections
Analytics

6.5.6 Host SSH daemon, if enabled, must set a timeout interval on idle sessions

Information

Implementing a timeout interval on idle SSH sessions ensures that any inactive session gets disconnected after a certain period, improving the security posture. The total timeout duration is calculated by multiplying the timeout count by the idle timeout interval.

Enforcing a timeout interval on idle SSH sessions minimizes the risk of unauthorized access through forgotten or unattended sessions, thereby hardening the system services as per security best practices.

Solution

To remediate this recommendation, set ClientAliveInterval to the approved number of seconds. Restart SSH if enabled and validate timeout behavior together with ClientAliveCountMax.

Impact:

No functional impact is reported with this control. The measure is preventive, aiming to mitigate risks associated with open, idle SSH sessions.

See Also

https://workbench.cisecurity.org/benchmarks/26357

Item Details

Category: CONFIGURATION MANAGEMENT, MAINTENANCE

References: 800-53|CM-7, 800-53|MA-4, CSCv7|5.1

Plugin: Unix

Control ID: e257726ebfeb3d739132d98392e56ec3af48e10c4860a5c7223d7f4a77435eca