mediumaccess-controlverified ✓rollback-safe
Set SSH client alive count maximum
ssh-client-alive-count-max · RHEL ≥ 8, UBUNTU ≥ 22 · 2 impls
Description
The SSH daemon must terminate sessions after a defined number of missed keepalive responses. ClientAliveCountMax sets how many client-alive messages can be sent without receiving a response before the server disconnects the session.
Rationale
A high ClientAliveCountMax allows sessions to persist long after the client has become unresponsive, leaving open sessions that an attacker could hijack. Setting the count to 1 ensures that a session is terminated promptly after the first missed keepalive, working in conjunction with ClientAliveInterval to enforce a strict idle timeout.
Check → Remediate
Checksshd_effective_config
- key:
- clientalivecountmax
- expected:
- 1
Remediateconfig_set
- path:
- /etc/ssh/sshd_config
- key:
- ClientAliveCountMax
- value:
- 1
- separator:
- reload:
- sshd
Framework references
STIG
V-230244 / RHEL-08-010200V-270742 / UBTU-24-600000V-260527 / UBTU-22-255030V-281269 / RHEL-10-700660
NIST 800-53
AC-12SC-10
Live verification
rhel10:checkrhel8:checkubuntu22:checkubuntu24:checkubuntu26:check
#ssh#session-management#timeout#idle