Detections
Analytics
ESXI-80-000210 - The ESXi host Secure Shell (SSH) daemon must set a timeout count on idle sessions.
Information
Setting a timeout ensures that a user login will be terminated as soon as the "ClientAliveCountMax" is reached.Solution
From an ESXi shell, run the following command:# esxcli system ssh server config set -k clientalivecountmax -v 3
or
From a PowerCLI command prompt while connected to the ESXi host, run the following commands:
$esxcli = Get-EsxCli -v2
$arguments = $esxcli.system.ssh.server.config.set.CreateArgs()
$arguments.keyword = 'clientalivecountmax'
$arguments.value = '3'
$esxcli.system.ssh.server.config.set.Invoke($arguments)
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_8-0_Y25M07_STIG.zip
Item Details
Audit Name: DISA VMware vSphere 8.0 ESXi STIG v2r3 Unix
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Rule-ID|SV-258765r959010_rule, STIG-ID|ESXI-80-000210, Vuln-ID|V-258765
Plugin: Unix
Control ID: 40eae6613f554544da03dfd55fb5627a78194733f8c4ba14e4235a51a5c695a0