Detections
Analytics

1.37 ESXI-80-000210

Information

The ESXi host Secure Shell (SSH) daemon must set a timeout count on idle sessions.

GROUP ID: V-258765
RULE ID: SV-258765r959010

Setting a timeout ensures that a user login will be terminated as soon as the "ClientAliveCountMax" is reached.

Solution

From an ESXi shell, run the following command:

esxcli system ssh server config set -k clientalivecountmax -v 3

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$arguments = $esxcli.system.ssh.server.config.set.CreateArgs()
$arguments.keyword = 'clientalivecountmax'
$arguments.value = '3'
$esxcli.system.ssh.server.config.set.Invoke($arguments)

See Also

https://workbench.cisecurity.org/benchmarks/23619

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Rule-ID|SV-258765r959010_rule, STIG-ID|ESXI-80-000210, Vuln-ID|V-258765

Plugin: Unix

Control ID: b12fd85bbed478f8a42bf62649f3b134d8fb99d0d00d590945a84f7611511de3