Cisco ASA
TMA-CISCO-ASA-1.8.3
Ensure 'HTTP idle timeout' is less than or equal to '5' minutes
HighLevel 1Automatedcisco-asa
Description
Sets the timeout for an HTTP session idle before the security appliance terminates it. Limiting session idle timeout prevents unauthorized users from using abandoned sessions to perform malicious activities. Audited against the output of 'show running-config' (run 'terminal pager 0' first; 'more system:running-config' also works and shows unmasked secrets).
How it is checked
Audit method: Configuration pattern
- Pattern
(?m)^http server idle-timeout [1-5]\s*$
How it is fixed
Fix method: Guidance or infrastructure patch
! - Step 1: Run the following to set the HTTP timeout to less than or equal to 5 minutes http server idle-timeout 5
Properties
- Operating systems
- Any
- Tags
- cisco-asanetworkntp
- Reference
- CIS Cisco ASA 9.x Firewall Benchmark v1.1.0 - 1.8.3 Ensure 'HTTP idle timeout' is less than or equal to '5' minutes
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target cisco-asa