The macOS system must configure the SSH ServerAliveInterval to 900.

An XCCDF Rule

Description

SSH must be configured with an Active Server Alive Maximum Count set to 900. Setting the Active Server Alive Maximum Count to 900 will log users out after a 900-second interval of inactivity. NOTE: /etc/ssh/ssh_config will be automatically modified to its original state following any update or major upgrade to the operating system.

ID: SV-268444r1034800_rule
Version: APPL-15-000110
Severity: Medium
References: CCI-001133
Updated: about 2 months ago

Remediation Templates

Configure the macOS system to set the SSH ServerAliveInterval to 900 with the following command:

include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/ssh_config | /usr/bin/tr -d '*')
  
  ssh_config_string=("ServerAliveInterval 900")
  for ssh_config in $ssh_config_string; do    ssh_setting=$(echo $ssh_config | /usr/bin/cut -d " " -f1)
    /usr/bin/grep -qEi "^$ssh_setting" "${include_dir}01-mscp-ssh.conf" && /usr/bin/sed -i "" "s/^$ssh_setting.*/${ssh_config}/" "${include_dir}01-mscp-ssh.conf" || echo "$ssh_config" >> "${include_dir}01-mscp-ssh.conf"
    for u in $(/usr/bin/dscl . list /users shell | /usr/bin/egrep -v '(^_)|(root)|(/usr/bin/false)' | /usr/bin/awk '{print $1}'); do
      config=$(/usr/bin/sudo -u $u /usr/bin/ssh -Gv . 2>&1)
      configfiles=$(echo "$config" | /usr/bin/awk '/Reading configuration data/ {print $NF}'| /usr/bin/tr -d '\r')
      configarray=( ${(f)configfiles} )
      if ! echo $config | /usr/bin/grep -q -i "$ssh_config" ; then
        for c in $configarray; do
          if [[ "$c" == "/etc/ssh/crypto.conf" ]]; then
            continue
          fi
          
          /usr/bin/sudo -u $u /usr/bin/grep -qEi "^$ssh_setting" "$c" && /usr/bin/sed -i "" "s/^$ssh_setting.*/${ssh_config}/I" "$c"
          if [[ "$c" =~ ".ssh/config" ]]; then
            if /usr/bin/grep -qEi "$ssh_setting" "$c" 2> /dev/null; then
              old_file=$(cat ~$u/.ssh/config)
              echo "$ssh_config" > ~$u/.ssh/config
              echo "$old_file" >> ~$u/.ssh/config
            fi
          fi
        done
      fi
    done
  done

The macOS system must configure the SSH ServerAliveInterval to 900.

Description

Remediation Templates

A Manual Procedure