APPL-11-000051 - The macOS system must be configured with the SSH daemon ClientAliveInterval option set to 900 or less.

Information

If SSH is not being used, this is Not Applicable.

The SSH daemon 'ClientAliveInterval' option must be set correctly. To check the idle timeout setting for SSH sessions, run the following:

/usr/bin/grep ^ClientAliveInterval /etc/ssh/sshd_config

If the setting is not '900' or less, this is a finding.

Solution

To ensure that 'ClientAliveInterval' is set correctly, run the following command:

/usr/bin/sudo /usr/bin/sed -i.bak 's/.*ClientAliveInterval.*/ClientAliveInterval 900/' /etc/ssh/sshd_config

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apple_macOS_11_V1R3_STIG.zip

Item Details

References: CAT|II, CCI|CCI-001133, Rule-ID|SV-230764r599842_rule, STIG-ID|APPL-11-000051, Vuln-ID|V-230764

Plugin: Unix

Control ID: 061ee4053a8825d272ebb1630ba1589d19fc2f2fcaa8c750ccc12c9594954391