[PATCH] Updated rationale for SSH Idle Timeout

Andrew Gilmore agilmore2 at gmail.com
Mon Jul 22 20:06:31 UTC 2013


The text of this rationale overstates the issue, as well as being
difficult to understand.

I had to fix this for my own use, so why not share?

Signed-off-by: Andrew Gilmore <agilmore2 at gmail.com>
---
 RHEL6/input/services/ssh.xml |    5 ++---
 1 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml
index 59330ab..c3b97cc 100644
--- a/RHEL6/input/services/ssh.xml
+++ b/RHEL6/input/services/ssh.xml
@@ -163,9 +163,8 @@ If properly configured, the output should be:
 <pre>ClientAliveInterval 900</pre>
 </ocil>
 <rationale>
-Causing idle users to be automatically logged out
-guards against compromises one system leading trivially
-to compromises on another.
+Automatically logging out idle users guards against one
+compromised system leading to access on another.
 </rationale>
 <ident cce="26919-1" />
 <oval id="sshd_idle_timeout" value="sshd_idle_timeout_value"/>
-- 
1.7.1



More information about the scap-security-guide mailing list