STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must be configured with a timeout interval for the Secure Shell (SSH) daemon.

DISA Rule

SV-281296r1184670_rule

Vulnerability Number

V-281296

Group Title

SRG-OS-000163-GPOS-00072

Rule Version

RHEL-10-700930

Severity

CAT II

CCI(s)

• CCI-001133 - Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.
• CCI-002361 - Automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.
• CCI-002891 - Verify session and network connection termination after the completion of nonlocal maintenance and diagnostic sessions.

Weight

10

Fix Recommendation

Configure RHEL 10 to automatically terminate all network connections associated with SSH traffic at the end of a session or after 10 minutes of inactivity.

Note: This setting must be applied in conjunction with RHEL-10-700660 to function correctly.

In "/etc/ssh/sshd_config.d", create a drop file that will lexicographically precede 50-redhat.conf and add the following line:

ClientAliveInterval 600

Restart the SSH daemon with the following command for the changes to take effect:

$ sudo systemctl restart sshd.service

Check Contents

Verify RHEL 10 is configured with an SSH timeout interval.

Verify the "ClientAliveInterval" variable is set to a value of "600" or less by performing the following command:

$ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*clientaliveinterval'
/etc/ssh/sshd_config.d/10-stig.conf::ClientAliveInterval 600

Verify the runtime setting with the following command:

$ sudo sshd -T | grep -i clientaliveinterval
clientaliveinterval 600

If the "ClientAliveInterval" keyword is not set to a value of "600" or less in a drop-in that lexicographically precedes 50-redhat.conf, or if no output is returned, this is a finding.

Vulnerability Number

V-281296

Documentable

False

Rule Version

RHEL-10-700930

Severity Override Guidance

Verify RHEL 10 is configured with an SSH timeout interval.

Verify the "ClientAliveInterval" variable is set to a value of "600" or less by performing the following command:

$ sudo /usr/sbin/sshd -dd 2>&1 | awk '/filename/ {print $4}' | tr -d '\r' | tr '\n' ' ' | xargs sudo grep -iH '^\s*clientaliveinterval'
/etc/ssh/sshd_config.d/10-stig.conf::ClientAliveInterval 600

Verify the runtime setting with the following command:

$ sudo sshd -T | grep -i clientaliveinterval
clientaliveinterval 600

If the "ClientAliveInterval" keyword is not set to a value of "600" or less in a drop-in that lexicographically precedes 50-redhat.conf, or if no output is returned, this is a finding.

Check Content Reference

M

Target Key

5733