← Back to VMware vRealize Operations Manager 6.x SLES Security Technical Implementation Guide

V-239449

CAT II (Medium)

The SLES for vRealize must initiate a session lock after a 15-minute period of inactivity for an SSH connection.

Rule ID

SV-239449r661798_rule

STIG

VMware vRealize Operations Manager 6.x SLES Security Technical Implementation Guide

Version

V2R2

CCIs

CCI-000057

Discussion

A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not log out because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, SLES for vRealize needs to be able to identify when a user's session has idled and take action to initiate the session lock. The session lock is implemented at the point where session activity can be determined and/or controlled.

Check Content

Verify SLES for vRealize initiates a session lock after a 15-minute period of inactivity for SSH. 

Execute the following command:

# grep ClientAliveInterval /etc/ssh/sshd_config; grep  ClientAliveCountMax /etc/ssh/sshd_config

Verify the following result:

ClientAliveInterval 900 
ClientAliveCountMax 0

If the session lock is not set to a 15-minute period, this is a finding.

Fix Text

Configure SLES for vRealize to initiate a session lock after a 15-minute period of inactivity for SSH.

Set the session lock after a 15-minute period by executing the following command:

# sed -i 's/^.*\bClientAliveInterval\b.*$/ClientAliveInterval 900/' /etc/ssh/sshd_config; sed -i 's/^.*\bClientAliveCountMax\b.*$/ClientAliveCountMax 0/' /etc/ssh/sshd_config