[PATCH] Updated rationale for SSH Idle Timeout
Shawn Wells
shawn at redhat.com
Tue Jul 23 00:24:25 UTC 2013
On 7/22/13 4:06 PM, Andrew Gilmore wrote:
> The text of this rationale overstates the issue, as well as being
> difficult to understand.
>
> I had to fix this for my own use, so why not share?
>
> Signed-off-by: Andrew Gilmore<agilmore2 at gmail.com>
> ---
> RHEL6/input/services/ssh.xml | 5 ++---
> 1 files changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/RHEL6/input/services/ssh.xml b/RHEL6/input/services/ssh.xml
> index 59330ab..c3b97cc 100644
> --- a/RHEL6/input/services/ssh.xml
> +++ b/RHEL6/input/services/ssh.xml
> @@ -163,9 +163,8 @@ If properly configured, the output should be:
> <pre>ClientAliveInterval 900</pre>
> </ocil>
> <rationale>
> -Causing idle users to be automatically logged out
> -guards against compromises one system leading trivially
> -to compromises on another.
$ git blame RHEL6/input/services/ssh.xml | grep "Causing idle"
1788d52f (Shawn Wells 2012-10-25 08:45:15 -0400 166) Causing idle
users to be automatically logged out
http://i.imgur.com/3xPms.gif
> +Automatically logging out idle users guards against one
> +compromised system leading to access on another.
> </rationale>
> <ident cce="26919-1" />
> <oval id="sshd_idle_timeout" value="sshd_idle_timeout_value"/>
> -- 1.7.1
Hopefully my name was attached to the original language through a
branch/merge, vs something I wrote!
Ack
More information about the scap-security-guide
mailing list