documentation_complete: true

title: 'Set SSH Client Alive Count'

description: |-
    To ensure the SSH idle timeout occurs precisely when the <tt>ClientAliveCountMax</tt> is set,
    edit <tt>/etc/ssh/sshd_config</tt> as follows:
    <pre>ClientAliveCountMax 0</pre>

rationale: |-
    This ensures a user login will be terminated as soon as the <tt>ClientAliveCountMax</tt>
    is reached.

severity: medium

identifiers:
    cce@rhel7: 27082-7

references:
    cis: 5.2.12
    cjis: 5.5.6
    cui: 3.1.11
    disa: 1133,2361
    hipaa: 164.308(a)(4)(i),164.308(b)(1),164.308(b)(3),164.310(b),164.312(e)(1),164.312(e)(2)(ii)
    nist: AC-2(5),SA-8,AC-12
    srg: SRG-OS-000163-GPOS-00072,SRG-OS-000279-GPOS-00109
    stigid@rhel7: "040340"

ocil_clause: 'it is commented out or not configured properly'

ocil: |-
    To ensure the SSH idle timeout will occur when the <tt>ClientAliveCountMax</tt> is set, run the following command:
    <pre>$ sudo grep ClientAliveCountMax /etc/ssh/sshd_config</pre>
    If properly configured, output should be:
    <pre>ClientAliveCountMax 0</pre>
