# CIS Ubuntu 14.04 LTS - 5.2.12 Ensure SSH Idle Timeout Interval is configured

> Verify SSH ClientAliveInterval and ClientAliveCountMax are configured for idle session timeout

- Skill: `cyberstrikeus/cis-ubuntu-14-04-lts-5-2-12-ensure-ssh-idle-timeout-interval` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-ubuntu-14-04-lts-5-2-12-ensure-ssh-idle-timeout-interval`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-ubuntu-14-04-lts-5-2-12-ensure-ssh-idle-timeout-interval/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-ubuntu-14-04-lts-5-2-12-ensure-ssh-idle-timeout-interval

---


# 5.2.12 Ensure SSH Idle Timeout Interval is configured (Scored)

## Profile Applicability

- Level 1 - Server
- Level 1 - Workstation

## Description

The two options `ClientAliveInterval` and `ClientAliveCountMax` control the timeout of ssh sessions. When the `ClientAliveInterval` variable is set, ssh sessions that have no activity for the specified length of time are terminated. When the `ClientAliveCountMax` variable is set, `sshd` will send client alive messages at every `ClientAliveInterval` interval. When the number of consecutive client alive messages are sent with no response from the client, the `ssh` session is terminated. For example, if the `ClientAliveInterval` is set to 15 seconds and the `ClientAliveCountMax` is set to 3, the client `ssh` session will be terminated after 45 seconds of idle time.

## Rationale

Having no timeout value associated with a connection could allow an unauthorized user access to another user's `ssh` session (e.g. user walks away from their computer and doesn't lock the screen). Setting a timeout value at least reduces the risk of this happening.

While the recommended setting is 300 seconds (5 minutes), set this timeout value based on site policy. The recommended setting for `ClientAliveCountMax` is 0. In this case, the client session will be terminated after 5 minutes of idle time and no keepalive messages will be sent.

## Audit Procedure

Run the following commands and verify `ClientAliveInterval` is between 1 and 300 and `ClientAliveCountMax` is 3 or less:

```bash
grep "^ClientAliveInterval" /etc/ssh/sshd_config
grep "^ClientAliveCountMax" /etc/ssh/sshd_config
```

## Expected Result

```
ClientAliveInterval 300
ClientAliveCountMax 0
```

## Remediation

Edit the `/etc/ssh/sshd_config` file to set the parameters according to site policy:

```
ClientAliveInterval 300
ClientAliveCountMax 0
```

## Default Value

ClientAliveInterval 0, ClientAliveCountMax 3

## References

- CIS Controls: 16.4 - Automatically Log Off Users After Standard Period Of Inactivity

## Profile

- Level 1 - Server
- Level 1 - Workstation