diff --git a/rules/os/os_sshd_client_alive_count_max_configure.yaml b/rules/os/os_sshd_client_alive_count_max_configure.yaml index d79624df..823e2b2a 100644 --- a/rules/os/os_sshd_client_alive_count_max_configure.yaml +++ b/rules/os/os_sshd_client_alive_count_max_configure.yaml @@ -1,7 +1,11 @@ id: os_sshd_client_alive_count_max_configure -title: "Set SSHD Active Client Alive Maximum to $ODV" +title: "Configure SSHD ClientAliveCountMax to $ODV" discussion: | - If SSHD is enabled it _MUST_ be configured with an Active Client Alive Maximum Count set to $ODV. Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session or an incomplete login attempt will also free up resources committed by the managed network element. + If SSHD is enabled it _MUST_ be configured with the Client Alive Maximum Count set to $ODV. + + This will set the number of client alive messages which may be sent without the SSH server receiving any messages back from the client. If this threshold is reached while client alive messages are being sent, the SSH server will disconnect the client, terminating the session. The client alive messages are sent through the encrypted channel and therefore will not be spoofable. The client alive mechanism is valuable when the client or server depend on knowing when a connection has become unresponsive. + + NOTE: This setting is not intended to manage idle user sessions where there is no input from the client. Its purpose is to monitor for interruptions in network connectivity and force the session to terminate after the connection appears to be broken. NOTE: /etc/ssh/sshd_config will be automatically modified to its original state following any update or major upgrade to the operating system. check: | diff --git a/rules/os/os_sshd_client_alive_interval_configure.yaml b/rules/os/os_sshd_client_alive_interval_configure.yaml index 77d962d5..312583a7 100644 --- a/rules/os/os_sshd_client_alive_interval_configure.yaml +++ b/rules/os/os_sshd_client_alive_interval_configure.yaml @@ -1,9 +1,13 @@ id: os_sshd_client_alive_interval_configure -title: "Configure SSHD ClientAliveInterval option set to $ODV" +title: "Configure SSHD ClientAliveInterval to $ODV" discussion: | - If SSHD is enabled then it _MUST_ be configured with an Active Client Alive Maximum Count set to $ODV. + If SSHD is enabled then it _MUST_ be configured with the Client Alive Interval set to $ODV. - Setting the Active Client Alive Maximum Count to $ODV (seconds) will log users out after an organizational defined interval of inactivity. + Sets a timeout interval in seconds after which if no data has been received from the client, sshd(8) will send a message through the encrypted channel to request a response from the client. + + This setting works in conjuction with ClientAliveCountMax to determine the termination of the connection after the threshold has been reached. + + NOTE: This setting is not intended to manage idle user sessions where there is no input from the client. Its purpose is to monitor for interruptions in network connectivity and force the session to terminate after the connection appears to be broken. NOTE: /etc/ssh/sshd_config will be automatically modified to its original state following any update or major upgrade to the operating system. check: |