The vCenter STS service must set an inactive timeout for sessions.
An XCCDF Rule
Description
Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after a set period of inactivity, the web server can make certain that those sessions that are not closed through the user logging out of an application are eventually closed. Satisfies: SRG-APP-000295-AS-000263, SRG-APP-000389-AS-000253
- ID
- SV-258983r1003673_rule
- Version
- VCST-80-000070
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Navigate to and open:
/usr/lib/vmware-sso/vmware-sts/conf/web.xml
Navigate to the <session-config> node and configure the <session-timeout> as follows: