AOSX-13-000721 - The macOS system must be configured with the SSH daemon ClientAliveCountMax option set to 0.


SSH should be configured to log users out after a 15-minute interval of inactivity and to wait only 30 seconds before timing out logon attempts. Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session or an incomplete logon attempt will also free up resources committed by the managed network element.


To ensure that the SSH idle timeout occurs precisely when the 'ClientAliveCountMax' is set, run the following command:

/usr/bin/sudo /usr/bin/sed -i.bak 's/.*ClientAliveCountMax.*/ClientAliveCountMax 0/' /etc/ssh/sshd_config

See Also

Item Details


References: 800-53|SC-10, CAT|II, CCI|CCI-001133, Rule-ID|SV-214887r609363_rule, STIG-ID|AOSX-13-000721, STIG-Legacy|SV-96367, STIG-Legacy|V-81653, Vuln-ID|V-214887

Plugin: Unix

Control ID: 94acd71750bb00b5b9a4e368b48743682f423df2ed316aab238b4ab243dae320