id: os_ssh_server_alive_count_max_configure
title: Set SSH Active Server Alive Maximum to $ODV
discussion: |
  SSH _MUST_ be configured with an Active Server Alive Maximum Count set to $ODV. Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session or an incomplete login attempt will also free up resources committed by the managed network element.

  NOTE: /etc/ssh/ssh_config will be automatically modified to its original state following any update or major upgrade to the operating system.

  NOTE: On macOS 15.2 and higher the SSH configuration can be reset to the macOS default by running /usr/libexec/reset-ssh-configuration.
check: |
  ret="pass"
  for u in $(/usr/bin/dscl . -list /Users UniqueID | /usr/bin/awk '$2 > 500 {print $1}'); do
    sshCheck=$(/usr/bin/sudo -u $u /usr/bin/ssh -G . | /usr/bin/grep -c "^serveralivecountmax $ODV")
    if [[ "$sshCheck" == "0" ]]; then
      ret="fail"
      break
    fi
  done
  /bin/echo $ret
result:
  string: pass
fix: |
  [source,bash]
  ----
  include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/ssh_config | /usr/bin/tr -d '*')
  
  ssh_config=("ServerAliveCountMax $ODV")
  
  ssh_setting=$(echo $ssh_config | /usr/bin/cut -d " " -f1)
  /usr/bin/grep -qEi "^$ssh_setting" "${include_dir}01-mscp-ssh.conf" && /usr/bin/sed -i "" "s/^$ssh_setting.*/${ssh_config}/" "${include_dir}01-mscp-ssh.conf" || echo "$ssh_config" >> "${include_dir}01-mscp-ssh.conf"
  for u in $(/usr/bin/dscl . list /users shell | /usr/bin/egrep -v '(^_)|(root)|(/usr/bin/false)' | /usr/bin/awk '{print $1}'); do
    config=$(/usr/bin/sudo -u $u /usr/bin/ssh -Gv . 2>&1)
    configfiles=$(echo "$config" | /usr/bin/awk '/Reading configuration data/ {print $NF}'| /usr/bin/tr -d '\r')
    configarray=( ${(f)configfiles} )
    if ! echo $config | /usr/bin/grep -q -i "$ssh_config" ; then
      for c in $configarray; do
        if [[ "$c" == "/etc/ssh/crypto.conf" ]]; then
          continue
        fi
        
        /usr/bin/sudo -u $u /usr/bin/grep -qEi "^$ssh_setting" "$c" && /usr/bin/sed -i "" "s/^$ssh_setting.*/${ssh_config}/I" "$c"
        if [[ "$c" =~ ".ssh/config" ]]; then
          if /usr/bin/grep -qEi "$ssh_setting" "$c" 2> /dev/null; then
            old_file=$(cat ~$u/.ssh/config)
            echo "$ssh_config" > ~$u/.ssh/config
            echo "$old_file" >> ~$u/.ssh/config
          fi
        fi
      done
    fi
  done

  ----  
references:
  cce:
    - CCE-94300-1
  cci:
    - CCI-001133
  800-53r5:
    - SC-10
  800-53r4:
    - SC-10
  srg:
    - SRG-OS-000163-GPOS-00072
  disa_stig:
    - APPL-15-000140
  800-171r3:
    - 03.13.09
  cmmc:
    - SC.L2-3.13.9
macOS:
  - '15.0'
odv:
  hint: Number of seconds.
  recommended: 0
  stig: 0
tags:
  - 800-53r5_moderate
  - 800-53r5_high
  - 800-53r4_moderate
  - 800-53r4_high
  - 800-171
  - cnssi-1253_low
  - cnssi-1253_high
  - cmmc_lvl2
  - stig
  - cnssi-1253_moderate
severity: medium
mobileconfig: false
mobileconfig_info:
