STIGQter: STIG Summary: Anduril NixOS Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Oct 2025:

NixOS must terminate all SSH connections after 10 minutes of becoming unresponsive.

DISA Rule

SV-268142r1131087_rule

Vulnerability Number

V-268142

Group Title

SRG-OS-000163-GPOS-00072

Rule Version

ANIX-00-000990

Severity

CAT II

CCI(s)

• CCI-001133 - Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.
• CCI-002361 - Automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.
• CCI-002891 - Verify session and network connection termination after the completion of nonlocal maintenance and diagnostic sessions.

Weight

10

Fix Recommendation

Configure NixOS to automatically terminate all network connections associated with SSH traffic after being unresponsive for 10 minutes.

Add the following Nix code to the NixOS Configuration, usually located in /etc/nixos/configuration.nix or /etc/nixos/flake.nix:

services.openssh.extraConfig = ''
ClientAliveInterval 600
'';

Rebuild and switch to the new NixOS configuration:
$ sudo nixos-rebuild switch

Check Contents

Verify that all network connections associated with SSH traffic are automatically terminated after 10 minutes of becoming unresponsive with the following command:

$ grep -i clientaliveinterval /etc/ssh/sshd_config

ClientAliveInterval 600

If "ClientAliveInterval" does not have a value of "600" or less, is commented out, or is missing, this is a finding.

Vulnerability Number

V-268142

Documentable

False

Rule Version

ANIX-00-000990

Severity Override Guidance

Verify that all network connections associated with SSH traffic are automatically terminated after 10 minutes of becoming unresponsive with the following command:

$ grep -i clientaliveinterval /etc/ssh/sshd_config

ClientAliveInterval 600

If "ClientAliveInterval" does not have a value of "600" or less, is commented out, or is missing, this is a finding.

Check Content Reference

M

Target Key

5658