Set 'exec-timeout' to less than or equal to 10 minutes 'line vty'

TinggiLevel 1Otomatiscisco-ios

Deskripsi

If no input is detected during the interval, the EXEC facility resumes the current connection. If no connections exist, the EXEC facility returns the terminal to the idle state and disconnects the incoming session. This prevents unauthorized users from misusing abandoned sessions. For example, if the network administrator leaves for the day and leaves a computer open with an enabled login session accessible. The 10 minute default is not shown in the config; fails only if a 'line vty' block sets a timeout above 10 minutes or disables it (0 0). Audited against the output of 'show running-config' (run 'terminal length 0' first; do not use 'show running-config all' or 'show startup-config').

Cara pemeriksaan

Metode audit: Pola konfigurasi

Pola: (?m)^line vty[^\n]*\n(?:[ \t][^\n]*\n)*?[ \t]+exec-timeout (?:0(?: 0)?|(?:1[1-9]|[2-9]\d|[1-9]\d{2,})(?: \d+)?|10 0*[1-9]\d*)[ \t\r]*$

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

! Configure device timeout (10 minutes or less) to disconnect sessions after a fixed idle time. line vty {line_number} [ending_line_number] exec-timeout <timeout_in_minutes> <timeout_in_seconds>

Properti

Sistem operasi: Apa saja
Tag: cisco-iosnetworkntp
Referensi: CIS Cisco IOS XE 17.x Benchmark v2.2.1 - 1.2.8 Set 'exec-timeout' to less than or equal to 10 minutes 'line vty'

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target cisco-ios