APPL-14-000120 - The macOS system must configure SSHD Channel Timeout to 900.

Information

If SSHD is enabled it must be configured with session Channel Timeout set to 900.

This will set the time out when the session is inactive.

Note: /etc/ssh/sshd_config will be automatically modified to its original state following any update or major upgrade to the operating system.

Satisfies: SRG-OS-000163-GPOS-00072,SRG-OS-000279-GPOS-00109

Solution

Configure the macOS system to set the SSHD Channel Timeout to 900 with the following command:

include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/sshd_config | /usr/bin/tr -d '*')

if [[ -z $include_dir ]]; then
/usr/bin/sed -i.bk '1s/.*/Include /etc/ssh/sshd_config.d/*/' /etc/ssh/sshd_config
fi

/usr/bin/grep -qxF 'channeltimeout session:*=900' '${include_dir}01-mscp-sshd.conf' 2>/dev/null || echo 'channeltimeout session:*=900' >> '${include_dir}01-mscp-sshd.conf'

for file in $(ls ${include_dir}); do
if [[ '$file' == '100-macos.conf' ]]; then
continue
fi
if [[ '$file' == '01-mscp-sshd.conf' ]]; then
break
fi
/bin/mv ${include_dir}${file} ${include_dir}20-${file}
done

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Apple_macOS_14_V2R1_STIG.zip

Item Details

Category: ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-12, 800-53|SC-10, CAT|II, CCI|CCI-001133, CCI|CCI-002361, Rule-ID|SV-259446r970703_rule, STIG-ID|APPL-14-000120, Vuln-ID|V-259446

Plugin: Unix

Control ID: 20b1e6d3efcc7c31d26316fc6f7832c517d8113d110678601f286d08ac67c0ad