Skip to content

Add variable selector and notes for ANSSI R29 #6553

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ggbecker merged 1 commit into from
Feb 3, 2021
Merged

Add variable selector and notes for ANSSI R29 #6553

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion controls/anssi.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -521,10 +521,22 @@ controls:
description: >-
Remote user sessions (shell access, graphical clients) must be closed
after a certain period of inactivity.
notes: >-
There is no specific capability to check remote user inactivity, but some shells allow the
session inactivity time out to be configured via TMOUT variable.
In OpenSSH < 8.2 the inactivity of the user is implied from the network inactivity.
The server is configured to disconnect sessions if no data has been received within the idle timeout,
regardless of liveness status (ClientAliveCountMax is 0 and ClientAliveInterval is > 0).
In OpenSSH >= 8.2 there is no way to disconnect sessions based on client liveness.
The semantics of "ClientAliveCountMax 0" has changed from "disconnect on first timeout" to
"don't disconnect network inactive sessions". The server either probes for the client liveness
or keeps inactive sessions connected.
automated: yes
rules:
- accounts_tmout
- var_accounts_tmout=10_min
- sshd_set_idle_timeout
- sshd_idle_timeout_value=5_minutes
- sshd_idle_timeout_value=10_minutes
- sshd_set_keepalive

- id: R30
Expand Down