TMA-OPNSENSE-2.1
Ensure Sessions Timeout is set to less than or equal to 10 Minutes
MediumLevel 1Automatedopnsense
Description
The session inactivity timeout setting represents the amount of time a user can be inactive before the user's session times out and closes. It only affects user browser sessions. Indefinite or even long session timeout window increase the risk of attackers abusing abandoned sessions
How it is checked
Audit method: Configuration pattern
- Pattern
<session_timeout>(?:[1-9]|10)</session_timeout>
How it is fixed
Fix method: Guidance or infrastructure patch
In GUI: - Navigate to System > Settings > Administration - Scroll to the 'Session Timeout' - Set 10 in the 'Session Timeout' field - Click Save
Properties
- Operating systems
- Any
- Tags
- opnsense
- Reference
- CIS OPNsense Benchmark v1.0.0 - 2.1 Ensure Sessions Timeout is set to less than or equal to 10 Minutes
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target opnsense