← Back to SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

V-22482

CAT III (Low)

The SSH daemon must limit connections to a single session.

Rule ID

SV-46097r1_rule

STIG

SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

Version

V1R12

CCIs

CCI-000054

Discussion

The SSH protocol has the ability to provide multiple sessions over a single connection without reauthentication. A compromised client could use this feature to establish additional sessions to a system without consent or knowledge of the user. Alternate per-connection session limits may be documented if needed for a valid mission requirement. Greater limits are expected to be necessary in situations where TCP or X11 forwarding are used.

Check Content

Check the SSH daemon configuration for the MaxSessions setting.
# grep -i MaxSessions /etc/ssh/sshd_config | grep -v '^#' 
If the setting is not present, or not set to "1", this is a finding.

Fix Text

Edit the SSH daemon configuration and add or edit the "MaxSessions" setting value to "1".