# Ensure sshd ClientAliveInterval and ClientAliveCountMax are configured

Necessity: The `ClientAliveInterval` and `ClientAliveCountMax` settings control the timeout for idle SSH sessions. Configuring them is crucial for security as it prevents sessions from remaining open indefinitely on an unattended terminal, mitigating the risk of session hijacking. It also helps free up system resources by automatically closing dead or unresponsive connections, which can prevent resource exhaustion and potential denial-of-service vectors.

Auditing and Remediation: The audit script inspects the `/etc/ssh/sshd_config` file to determine the currently configured values for `ClientAliveInterval` and `ClientAliveCountMax`, reporting them as a single string. The remediation script modifies this same configuration file, setting the values to the desired state, and then restarts the SSH daemon (`sshd`) to enforce the new policy.

Recommended State Rationale: The states are defined as a 'Interval:Count' pair. 
- Basic (`['300:0']`): This state aligns with CIS benchmarks, setting a 5-minute interval. It ensures sessions are checked periodically without being overly aggressive. Setting `ClientAliveCountMax` to 0 disables the server-side disconnect mechanism based on count, relying on TCP timeouts to close the connection, which effectively terminates the session if the client is unreachable.
- Moderate (`['180:0']`): A more assertive 3-minute interval for environments requiring quicker termination of idle sessions to reduce the window of opportunity for unauthorized access.
- Strict (`['60:0']`): An aggressive 1-minute timeout suitable for high-security environments where the risk associated with an unattended session is critical. This ensures that any unresponsive connection is terminated very rapidly.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['300:0']` |
| **Moderate** | `['180:0']` |
| **Strict** | `['60:0']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that reads the `/etc/ssh/sshd_config` file to find the active values for `ClientAliveInterval` and `ClientAliveCountMax`. The script should handle commented-out lines and missing entries, using the system defaults (ClientAliveInterval=0, ClientAliveCountMax=3) in those cases. It must output the values as a colon-separated string, e.g., '300:0', with no extra text or labels.

## Remediation Script Working

Bash script that accepts two positional command-line arguments: the desired `ClientAliveInterval` (first argument) and `ClientAliveCountMax` (second argument). The script must locate and update these settings in `/etc/ssh/sshd_config`, uncommenting or adding them if necessary. After successfully modifying the file, it should restart the sshd service to apply the changes. The script must output `true` on successful completion and `false` if any step fails.

