<Group id="ssh">
<title>SSH Server</title>
<description>The SSH protocol is recommended for remote login and remote file
transfer. SSH provides confidentiality and integrity for data exchanged between
two systems, as well as server authentication, through the use of public key
cryptography. The implementation included with the system is called OpenSSH,
and more detailed documentation is available from its website,
http://www.openssh.org. Its server program is called <tt>sshd</tt> and
provided by the RPM package <tt>openssh-server</tt>.</description>

<Value id="sshd_idle_timeout_value" type="number" operator="equals" interactive="0">
<title>SSH session Idle time</title>
<description>Specify duration of allowed idle time.</description>
<value selector="">300</value>
<value selector="5_minutes">300</value>
<value selector="10_minutes">600</value>
<value selector="15_minutes">900</value>
</Value>

<Group id="ssh_server">
<title>Configure OpenSSH Server if Necessary</title>
<description>If the system needs to act as an SSH server, then certain changes
should be made to the OpenSSH daemon configuration file
<tt>/etc/ssh/sshd_config</tt>. The following recommendations can be applied
to this file. See the <tt>sshd_config(5)</tt> man page for more detailed
information.</description>

<Rule id="sshd_disable_root_login" severity="medium">
<title>SSH Root Login Disabled</title>
<description>The root user should never be allowed to login to a system
directly over a network. To disable root login via SSH, add or correct the
following line in <tt>/etc/ssh/sshd_config</tt>:
<pre>PermitRootLogin no</pre>
</description>
<rationale>
Permitting direct root login reduces auditable information about who ran
privileged commands on the system and also allows direct attack attempts on
root's password.
</rationale>
<oval id="sshd_disable_root_login" />
<ref nist="AC-6(2),IA-2(1)" disa="770" />
</Rule>

<Rule id="sshd_disable_empty_passwords" severity="high">
<title>SSH Access via Empty Passwords Disabled</title>
<description>To explicitly disallow remote login from accounts with empty
passwords, add or correct the following line in <tt>/etc/ssh/sshd_config</tt>:
<pre>PermitEmptyPasswords no</pre>
Any accounts with empty passwords should be disabled immediately, and PAM
configuration should prevent users from being able to assign themselves empty
passwords.
</description>
<rationale>
Configuring this setting for the SSH daemon provides additional assurance that
remote login via SSH will require a password, even in the event of
misconfiguration elsewhere.
</rationale>
<oval id="sshd_disable_empty_passwords" />
<ref disa="765,766"/>
</Rule>

<Rule id="sshd_set_idle_timeout">
<title>SSH Idle Timeout Interval Used</title>
<description>SSH allows administrators to set an idle timeout interval.
After this interval has passed, the idle user will be automatically logged out.
<br /><br />
To set an idle timeout interval, edit the <tt>/etc/ssh/sshd_config</tt> file,
locate the following line:
<pre>ClientAliveInterval <b>INTERVAL</b></pre>
and correct it to have the form of:
<pre>ClientAliveInterval <b><sub idref="sshd_idle_timeout_value" /></b></pre>
The timeout <b>INTERVAL</b> is given in seconds. To have a timeout of 15
minutes, set <b>INTERVAL</b> to 900.
<br /><br />
If a shorter timeout has already been set for the login shell, that value will
preempt any SSH setting made here. Keep in mind that some processes may stop
SSH from correctly detecting that the user is idle.
</description>
<rationale>
Causing idle users to be automatically logged out guards against compromises
one system leading trivially to compromises on another.
</rationale>
<oval id="sshd_set_idle_timeout" value="sshd_idle_timeout_value"/>
<ref disa="879,1133"/>
</Rule>

<Rule id="sshd_set_keepalive">
<title>SSH Client Alive Count Used</title>
<description>To ensure the SSH idle timeout occurs precisely when the
<tt>ClientAliveCountMax</tt> is set, edit <tt>/etc/ssh/sshd_config</tt> as
follows:
<pre>ClientAliveCountMax 0</pre>
</description>
<rationale>
This ensures a user login will be terminated as soon as the
<tt>ClientAliveCountMax</tt> is reached.
</rationale>
<oval id="sshd_set_keepalive" />
<ref disa="879,1133"/>
</Rule>

</Group>
</Group>
