macOS 15 - Sequoia
The macOS system must configure SSHD unused connection timeout to 900
Description
If SSHD is enabled, it must be configured with unused connection timeout set to 900.This will set the timeout when there are no open channels within a session.NOTE: /etc/ssh/sshd_config will be automatically modified to its original state following any update or major upgrade to the operating system.Satisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109
Check
Verify the macOS system is configured to set the SSHD unused connection timeout to 900 with the following command:/usr/sbin/sshd -G | /usr/bin/awk '/unusedconnectiontimeout/{print $2}'If the result is not "900", this is a finding.
Fix
Configure the macOS system to set the SSHD unused connection timeout to 900 with the following command:include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/sshd_config | /usr/bin/tr -d '*')if [[ -z $include_dir ]]; then /usr/bin/sed -i.bk "1s/.*/Include \/etc\/ssh\/sshd_config.d\/\*/" /etc/ssh/sshd_configfi/usr/bin/grep -qxF 'unusedconnectiontimeout 900' "${include_dir}01-mscp-sshd.conf" 2>/dev/null || echo "unusedconnectiontimeout 900" >> "${include_dir}01-mscp-sshd.conf"for file in $(ls ${include_dir}); do if [[ "$file" == "100-macos.conf" ]]; then continue fi if [[ "$file" == "01-mscp-sshd.conf" ]]; then break fi /bin/mv ${include_dir}${file} ${include_dir}20-${file}done