Details

The session timeout should be configured to a nonzero value. The session timeout default value is 30 minutes; when the timeout period has elapsed with no user activity, the session will be terminated and the user will be required to log in again.

Solution

Use the following command to set the session timeout to 5 minutes:

switch(config)# session-timeout 5

The session timeout period can be set between 0 (disabled) and 43,200 minutes (30 days), and applies to serial console and SSH sessions; it does not apply to the web UI.

Supportive Information

The following resource is also helpful.

• https://support.hpe.com/hpesc/public/docDisplay?docId=a00053695en_us

This security hardening control applies to the following category of controls within NIST 800-53: Access Control.This control applies to the following type of system ArubaOS.

References

• 800-53|AC-12.
• CSCv6|16.4

Source

• Tenable.com/audits