5.8 Ensure idle ESXi shell and SSH sessions time out after 300 seconds or less

Information

The ESXiShellInteractiveTimeOut allows you to automatically terminate idle ESXi shell and SSH sessions. The permitted idle time should be 300 seconds or less.

Rationale:

If a user forgets to log out of an ESXi shell or SSH session, the idle session will exist indefinitely, increasing the potential for someone to gain unauthorized privileged access to the host, unless a timeout is set.

Solution

To set the timeout to the desired value, perform the following from the vSphere web client:

From the vSphere Web Client, select the host.

Click Configure then expand System.

Select Advanced System Settings then click Edit.

Enter ESXiShellInteractiveTimeOut in the filter.

Set the value for this parameter is set to the appropriate value (300 seconds or less).

Click OK.

Note: A value of 0 disables the ESXi ShellInteractiveTimeOut.
Alternately, use the following PowerCLI command:

# Set Remove UserVars.ESXiShellInteractiveTimeOut to 300 on all hosts
Get-VMHost | Get-AdvancedSetting -Name 'UserVars.ESXiShellInteractiveTimeOut' | Set-AdvancedSetting -Value '300'

See Also

https://workbench.cisecurity.org/files/3473