Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updating regex for clientalivecountmax to match requirement standard #54

Open
wants to merge 4 commits into
base: benchmark_v1.0.0
Choose a base branch
from

Conversation

jflatten
Copy link

Overall Review of Changes:

  • Updated 5.2.20 to check that /etc/ssh/sshd_config contains ClientAliveCountMax value > 0
  • Updated 5.2.20 to check that stdout of sshd -T | grep clientalive contains clientalivecountmax > 0

Issue Fixes:
This fixes the interpretation of the v1 5.2.20 rule. The CIS standard states:

ClientAliveCountMax must be greater than zero in order to utilize the ability of SSH to drop idle connections. If connections are allowed to stay open indefinitely, this can potentially be used as a DDOS attack or simple resource exhaustion could occur over unreliable networks.

How has this been tested?:
Tested on deployment of RHEL9 AMI running in AWS. I have not tested negative/postive results. Please let me know if you need more testing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants