macOS 15 - Sequoia

The macOS system must configure SSHD unused connection timeout to 900

Description

If SSHD is enabled, it must be configured with unused connection timeout set to 900.This will set the timeout when there are no open channels within a session.NOTE: /etc/ssh/sshd_config will be automatically modified to its original state following any update or major upgrade to the operating system.Satisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109

Check

C-268446r1034278_chk

Verify the macOS system is configured to set the SSHD unused connection timeout to 900 with the following command:/usr/sbin/sshd -G | /usr/bin/awk '/unusedconnectiontimeout/{print $2}'If the result is not "900", this is a finding.

Fix

F-72377r1034277_fix

Configure the macOS system to set the SSHD unused connection timeout to 900 with the following command:include_dir=$(/usr/bin/awk '/^Include/ {print $2}' /etc/ssh/sshd_config | /usr/bin/tr -d '*')if [[ -z $include_dir ]]; then /usr/bin/sed -i.bk "1s/.*/Include \/etc\/ssh\/sshd_config.d\/\*/" /etc/ssh/sshd_configfi/usr/bin/grep -qxF 'unusedconnectiontimeout 900' "${include_dir}01-mscp-sshd.conf" 2>/dev/null || echo "unusedconnectiontimeout 900" >> "${include_dir}01-mscp-sshd.conf"for file in $(ls ${include_dir}); do if [[ "$file" == "100-macos.conf" ]]; then continue fi if [[ "$file" == "01-mscp-sshd.conf" ]]; then break fi /bin/mv ${include_dir}${file} ${include_dir}20-${file}done