|
 |
a297d8 |
From 4d67a36c0a07ef8e07b8760b0e883bd42c0177ec Mon Sep 17 00:00:00 2001
|
|
|
a297d8 |
From: Watson Sato <wsato@redhat.com>
|
|
|
a297d8 |
Date: Thu, 21 Jan 2021 11:04:05 +0100
|
|
|
a297d8 |
Subject: [PATCH] Add variable selector and notes for R29
|
|
|
a297d8 |
|
|
|
a297d8 |
---
|
|
|
a297d8 |
controls/anssi.yml | 14 +++++++++++++-
|
|
|
a297d8 |
1 file changed, 13 insertions(+), 1 deletion(-)
|
|
|
a297d8 |
|
|
|
a297d8 |
diff --git a/controls/anssi.yml b/controls/anssi.yml
|
|
|
a297d8 |
index dec9d68c99..3303d70295 100644
|
|
|
a297d8 |
--- a/controls/anssi.yml
|
|
|
a297d8 |
+++ b/controls/anssi.yml
|
|
|
a297d8 |
@@ -521,10 +521,22 @@ controls:
|
|
|
a297d8 |
description: >-
|
|
|
a297d8 |
Remote user sessions (shell access, graphical clients) must be closed
|
|
|
a297d8 |
after a certain period of inactivity.
|
|
|
a297d8 |
+ notes: >-
|
|
|
a297d8 |
+ There is no specific capability to check remote user inactivity, but some shells allow the
|
|
|
a297d8 |
+ session inactivity time out to be configured via TMOUT variable.
|
|
|
a297d8 |
+ In OpenSSH < 8.2 the inactivity of the user is implied from the network inactivity.
|
|
|
a297d8 |
+ The server is configured to disconnect sessions if no data has been received within the idle timeout,
|
|
|
a297d8 |
+ regardless of liveness status (ClientAliveCountMax is 0 and ClientAliveInterval is > 0).
|
|
|
a297d8 |
+ In OpenSSH >= 8.2 there is no way to disconnect sessions based on client liveness.
|
|
|
a297d8 |
+ The semantics of "ClientAliveCountMax 0" has changed from "disconnect on first timeout" to
|
|
|
a297d8 |
+ "don't disconnect network inactive sessions". The server either probes for the client liveness
|
|
|
a297d8 |
+ or keeps inactive sessions connected.
|
|
|
a297d8 |
+ automated: yes
|
|
|
a297d8 |
rules:
|
|
|
a297d8 |
- accounts_tmout
|
|
|
a297d8 |
+ - var_accounts_tmout=10_min
|
|
|
a297d8 |
- sshd_set_idle_timeout
|
|
|
a297d8 |
- - sshd_idle_timeout_value=5_minutes
|
|
|
a297d8 |
+ - sshd_idle_timeout_value=10_minutes
|
|
|
a297d8 |
- sshd_set_keepalive
|
|
|
a297d8 |
|
|
|
a297d8 |
- id: R30
|