macOS 15 - Sequoia
The macOS system must configure SSHD channel timeout to 900
Description
If SSHD is enabled, it must be configured with session ChannelTimeout set to 900.This will set the timeout when the session is inactive.NOTE: /etc/ssh/sshd_config will be automatically modified to its original state following any update or major upgrade to the operating system.Satisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109
Check
Verify the macOS system is configured to set the SSHD Channel Timeout to 900 with the following command:/usr/sbin/sshd -G | /usr/bin/awk -F "=" '/channeltimeout session:*/{print $2}'If the result is not "900", this is a finding.
Fix
Configure the macOS system to set the SSHD ChannelTimeout to 900 with the following command:include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/sshd_config | /usr/bin/tr -d '*')if [[ -z $include_dir ]]; then /usr/bin/sed -i.bk "1s/.*/Include \/etc\/ssh\/sshd_config.d\/\*/" /etc/ssh/sshd_configfi/usr/bin/grep -qxF 'channeltimeout session:*=900' "${include_dir}01-mscp-sshd.conf" 2>/dev/null || echo "channeltimeout session:*=900" >> "${include_dir}01-mscp-sshd.conf"for file in $(ls ${include_dir}); do if [[ "$file" == "100-macos.conf" ]]; then continue fi if [[ "$file" == "01-mscp-sshd.conf" ]]; then break fi /bin/mv ${include_dir}${file} ${include_dir}20-${file}done