Detections
Analytics

6.5.5 Host SSH daemon, if enabled, must set a timeout count on idle sessions

Information

Setting a timeout count on idle SSH sessions ensures that inactive sessions are automatically disconnected after a specified period. This period is calculated by multiplying the timeout count with the idle timeout interval. Automatic disconnection of idle sessions reduces the window of opportunity for unauthorized access.

Implementing a timeout count on idle sessions promotes better security hygiene by minimizing the exposure of open SSH sessions. It adds a layer of protection against potential unauthorized access arising from forgotten or unattended sessions.

Solution

To remediate this recommendation, set ClientAliveCountMax to the approved value, then restart SSH if enabled and test that inactive sessions are closed after the configured interval/count.

Impact:

There's no functional impact reported with this control. It's a preventive measure aimed at enhancing the security posture by mitigating the risks associated with lingering idle sessions.

See Also

https://workbench.cisecurity.org/benchmarks/28124

Item Details

Category: CONFIGURATION MANAGEMENT, MAINTENANCE

References: 800-53|CM-7, 800-53|MA-4, CSCv7|5.1

Plugin: Unix

Control ID: e526ec4684b370165ee800cc2d4dff0486327da6c9b6a2d27a1a29a402a89992