This improvement was originally proposed by Tomas Heinrich for USGCB content.
But it is applicable to SSG content too, therefore this post.
Rationale:
----------
When checking the system for underlying value of ClientAliveInterval sshd config
variable it's not sufficient to check just for upper bound (if the present value is
less than required maximum), but it is necessary to check also for lower bound. Because
from the sshd_config manual page:
ClientAliveInterval
Sets a timeout interval in seconds after which if no data has been received
from the client, sshd(8) will send a message through the
encrypted channel to request a response from the client. The default is 0,
indicating that these messages will not be sent to the
client. This option applies to protocol version 2 only.
Conclusion:
-----------
The current form worked only for instances, not having ClientAliveInterval at all in
the
config. But having had that value set to zero, would still pass (which is wrong, since as
mentioned above these messages would still not be sent). Thus this patch adds also check
if actual value is greater than zero.
Besides that it add some blank lines for better readability. Also removes Fedora
version
of sshd_set_idle_timeout.xml rule and links to shared one.
Testing background:
-------------------
Has been tested on RHEL-7 & Fedora-20 and seems to be working properly.
Please review.
Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Technologies Team