The HYCU 4.1 application and server must initiate a session lock after a 15-minute period of inactivity.
An XCCDF Rule
Description
<VulnDiscussion>A session lock is a temporary network device or administrator-initiated action taken when the administrator stops work but does not log out of the network device. Rather than relying on the user to manually lock their management session prior to vacating the vicinity, network devices need to be able to identify when a management session has idled and take action to initiate the session lock. Once invoked, the session lock must remain in place until the administrator reauthenticates. No other system activity aside from reauthentication must unlock the management session.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-246820r768124_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Log on to the VM console and use the following command to edit the "sshd_config" file:
vi /etc/ssh/sshd_config
ClientAliveInterval 15m # 15 minutes
ClientAliveCountMax 0 # 0 times
Web UI by default performs an automatic logout after 15 minutes of user inactivity. Do the following to further tweak the inactivity timeout if required: