# Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured

Necessity: Configuring SSH client alive messages is crucial for security as it automatically terminates idle or unresponsive SSH sessions. This mitigates the risk of an attacker hijacking an unattended, open terminal session to gain unauthorized access to the system. Without these settings, a session could remain open indefinitely, creating a persistent security vulnerability.

Auditing and Remediation: The audit script checks the '/etc/ssh/sshd_config' file to retrieve the current values for 'ClientAliveInterval' and 'ClientAliveCountMax'. The remediation script modifies these same parameters within the configuration file to enforce the desired timeout policy and reloads the SSH daemon to ensure the new settings take effect.

Recommended State Rationale:
- Basic ['900:0']: This state sets a 15-minute (900 seconds) timeout. It provides a foundational level of security by terminating sessions that have been idle for a significant period without being overly aggressive.
- Moderate ['300:0']: This state reduces the timeout to 5 minutes (300 seconds), aligning with security benchmarks such as the Center for Internet Security (CIS). This significantly shortens the window of opportunity for session hijacking.
- Strict ['300:0']: This state also uses a 5-minute timeout. This is considered a robust industry best practice. Setting 'ClientAliveCountMax' to '0' ensures that the connection is terminated immediately after the first keep-alive probe fails, providing the fastest possible disconnection for an unresponsive session and representing a strong security posture.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['900:0']` |
| **Moderate** | `['300:0']` |
| **Strict** | `['300:0']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the '/etc/ssh/sshd_config' file for the 'ClientAliveInterval' and 'ClientAliveCountMax' settings. The script must parse the current values and output them as a single string in the format 'INTERVAL:COUNTMAX', such as '300:0'. It must not output any other text or labels.

## Remediation Script Working

Bash script that accepts two positional command-line arguments: the desired 'ClientAliveInterval' ($1) and 'ClientAliveCountMax' ($2). The script must update the '/etc/ssh/sshd_config' file with these values, creating the lines if they do not exist. After successfully modifying the configuration, the script must reload the sshd service to apply the changes. The script must output 'true' on success and 'false' on failure.

