Detections
Analytics

1.38 ESXI-80-000211

Information

The ESXi host Secure Shell (SSH) daemon must set a timeout interval on idle sessions.

GROUP ID: V-258766
RULE ID: SV-258766r959010

Automatically logging out idle users guards against compromises via hijacked administrative sessions.

Solution

From an ESXi shell, run the following command:

esxcli system ssh server config set -k clientaliveinterval -v 200

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$arguments = $esxcli.system.ssh.server.config.set.CreateArgs()
$arguments.keyword = 'clientaliveinterval'
$arguments.value = '200'
$esxcli.system.ssh.server.config.set.Invoke($arguments)

See Also

https://workbench.cisecurity.org/benchmarks/23619

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Rule-ID|SV-258766r959010_rule, STIG-ID|ESXI-80-000211, Vuln-ID|V-258766

Plugin: Unix

Control ID: d8fc42477cfcddf1ec083dedd409eb90c724dd2426c19fafc82b1238b6a40a68