The NSX-T Manager must prohibit the use of cached authenticators after an organization-defined time period.
Severity | Group ID | Group Title | Version | Rule ID | Date | STIG Version |
|---|---|---|---|---|---|---|
| medium | V-251784 | SRG-APP-000400-NDM-000313 | TNDM-3X-000076 | SV-251784r879773_rule | 2023-06-22 | 1 |
Description
Some authentication implementations can be configured to use cached authenticators.
If cached authentication information is out-of-date, the validity of the authentication information may be questionable.
The organization-defined time period should be established for each device depending on the nature of the device; for example, a device with just a few administrators in a facility with spotty network connectivity may merit a longer caching time period than a device with many administrators.
ℹ️ Check
From an NSX-T Manager shell, run the following command(s):
> get service http | find Session
Expected result:
Session timeout: 600
If the output does not match the expected result, this is a finding.
From an NSX-T Manager shell, run the following command(s):
> get cli-timeout
Expected result:
600 seconds
If the output does not match the expected result, this is a finding.
✔️ Fix
From an NSX-T Manager shell, run the following command(s):
> set service http session-timeout 600
> set cli-timeout 600