<div dir="ltr"><div>I'd still like to push for something more than 15 minutes. It's just too short.<br><br></div>Thanks,<br><br>Trevor<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, May 14, 2014 at 6:05 PM, David Smith <span dir="ltr"><<a href="mailto:dsmith@secure-innovations.net" target="_blank">dsmith@secure-innovations.net</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">It seems to have been missed on the CS2 side. It's likely that it was refined internally at some point, but a subsequent version of the SSG content overwrote it. I'll make a note to get the fix handled this week - thanks for letting us know!<div>
<div class="h5"><div class="gmail_extra">
<br><br><div class="gmail_quote">On Wed, May 14, 2014 at 5:06 PM, Shawn Wells <span dir="ltr"><<a href="mailto:shawn@redhat.com" target="_blank">shawn@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div><br>
On 5/14/14, 4:37 PM, Trevor Vaughan wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Ok, I realize that this went through a while ago but has anyone actually lived with this setting enabled?<br>
<br>
I've got a LOT of unhappy users that start to VI a file, walk away for a while (with their local screen locked) and come back to find their sessions dumped all over the floor.<br>
<br>
The default appears to be 5 minutes across the board which I find WAY too short since I might be looking at a man page in two windows for that amount of time or more.<br>
<br>
I would like to propose that the defaults be changed to something more sensible like 2, 4, or 8 hours. (Heck, meetings can go on for more than 2 hours sometimes)<br>
<br>
Thanks,<br>
</blockquote>
<br></div>
The default value is 5 minutes:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<Value id="sshd_idle_timeout_value" type="number"<br>
operator="equals" interactive="0"><br>
<title>SSH session Idle time</title><br>
<description>Specify duration of allowed idle time.</description><br>
<value selector="">300</value><br>
<value selector="5_minutes">300</<u></u>value><br>
<value selector="10_minutes">600</<u></u>value><br>
<value selector="15_minutes">900</<u></u>value><br>
</Value><br>
</blockquote>
<br>
<br>
STIG value is 15 minutes:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
$ grep -rin sshd_idle_timeout_value profiles/<br>
profiles/stig-rhel6-server-<u></u>upstream.xml:114:<refine-value idref="sshd_idle_timeout_<u></u>value" selector="15_minutes"/><br>
profiles/rht-ccp.xml:9:<<u></u>refine-value idref="sshd_idle_timeout_<u></u>value" selector="5_minutes"/><br>
profiles/common.xml:299:<<u></u>refine-value idref="sshd_idle_timeout_<u></u>value" selector="5_minutes"/><br>
</blockquote>
<br>
Interestingly, the CS2 profile doesn't refine the sshd_idle_timeout_value, thus inheriting the 5 minute constraint....<br>
<br>
/me eyeballs dave smith to see if this was an oversight in the CS2 profile<div><div><br>
______________________________<u></u>_________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org" target="_blank">scap-security-guide@lists.<u></u>fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.<u></u>org/mailman/listinfo/scap-<u></u>security-guide</a><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>
</div></div></div></div>
<br>_______________________________________________<br>
scap-security-guide mailing list<br>
<a href="mailto:scap-security-guide@lists.fedorahosted.org">scap-security-guide@lists.fedorahosted.org</a><br>
<a href="https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide" target="_blank">https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide</a><br>
<br></blockquote></div><br><br clear="all"><br>-- <br>Trevor Vaughan<br>Vice President, Onyx Point, Inc<br>(410) 541-6699<br><a href="mailto:tvaughan@onyxpoint.com">tvaughan@onyxpoint.com</a><br><br>-- This account not approved for unencrypted proprietary information --
</div>