mediumaccess-controlverified ✓rollback-safe

Set SSH client alive interval

ssh-client-alive-interval · RHEL ≥ 8 · 2 impls

Description

The SSH daemon must send keepalive messages to detect idle or unresponsive clients. ClientAliveInterval specifies the number of seconds the server waits before sending a null packet to the client to request a response.

Rationale

Idle SSH sessions that remain open indefinitely pose a security risk because an unattended terminal can be used by anyone with physical or logical access to the workstation. Setting ClientAliveInterval to 600 seconds ensures that sessions are terminated within 10 minutes of becoming unresponsive, limiting the window of opportunity for session hijacking.

Check → Remediate

Checkcommand

val=$(sshd -T 2>/dev/null | grep -i '^clientaliveinterval ' | awk '{print $2}')
if [ -z "$val" ]; then echo "FAIL: clientaliveinterval not found"; exit 1; fi
if [ "$val" -eq 0 ] || [ "$val" -gt {{ ssh_client_alive_interval }} ]; then
  echo "FAIL: clientaliveinterval=$val (expected <= {{ ssh_client_alive_interval }})"
  exit 1
fi
echo "OK: clientaliveinterval=$val"

expected_exit:: 0

Remediateconfig_set

path:: /etc/ssh/sshd_config
key:: ClientAliveInterval
value:: {{ ssh_client_alive_interval }}
separator:
reload:: sshd

Framework references

CIS

rhel10 5.1.7rhel8 5.1.9rhel9 5.1.9

STIG

V-281296 / RHEL-10-700930V-244525 / RHEL-08-010201V-257996 / RHEL-09-255100

NIST 800-53

AC-12SC-10

Live verification

rhel10:checkrhel8:checkrhel9:check

#ssh#session-management#timeout#idle