The macOS system must configure SSHD channel timeout to 900.

An XCCDF Rule

Description

If SSHD is enabled, it must be configured with session ChannelTimeout set to 900. This will set the timeout when the session is inactive. NOTE: /etc/ssh/sshd_config will be automatically modified to its original state following any update or major upgrade to the operating system. Satisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109

ID: SV-268445r1034275_rule
Version: APPL-15-000120
Severity: Medium
References: CCI-001133 CCI-002361
Updated: about 2 months ago

Remediation Templates

Configure the macOS system to set the SSHD ChannelTimeout to 900 with the following command:

include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/sshd_config | /usr/bin/tr -d '*')

if [[ -z $include_dir ]]; then
  /usr/bin/sed -i.bk "1s/.*/Include \/etc\/ssh\/sshd_config.d\/\*/" /etc/ssh/sshd_configfi

/usr/bin/grep -qxF 'channeltimeout session:*=900' "${include_dir}01-mscp-sshd.conf" 2>/dev/null || echo "channeltimeout session:*=900" >> "${include_dir}01-mscp-sshd.conf"

for file in $(ls ${include_dir}); do
  if [[ "$file" == "100-macos.conf" ]]; then
      continue
  fi
  if [[ "$file" == "01-mscp-sshd.conf" ]]; then
      break
  fi
  /bin/mv ${include_dir}${file} ${include_dir}20-${file}
done

The macOS system must configure SSHD channel timeout to 900.

Description

Remediation Templates

A Manual Procedure