documentation_complete: true

title: 'Set SSH Client Alive Count'

description: |-
    To ensure the SSH idle timeout occurs precisely when the <tt>ClientAliveCountMax</tt> is set,
    edit <tt>/etc/ssh/sshd_config</tt> as
    follows:
    <pre>ClientAliveCountMax 0</pre>

rationale: |-
    This ensures a user login will be terminated as soon as the <tt>ClientAliveCountMax</tt>
    is reached.

severity: unknown

identifiers:
    cce: ""

references:
    nist: AC-2(5),SA-8

ocil_clause: 'it is not'

ocil: |-
    To ensure the SSH idle timeout will occur when the <tt>ClientAliveCountMax</tt> is set, run the following command:
    <pre>$ sudo grep ClientAliveCountMax /etc/ssh/sshd_config</pre>
    If properly configured, output should be:
    <pre>ClientAliveCountMax 0</pre>
