Detections
Analytics

1.14 VCLU-80-000070

Information

The vCenter Lookup service must set an inactive timeout for sessions.

GROUP ID: V-259049RULE ID: SV-259049r1003620

Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after a set period of inactivity, the web server can make certain that those sessions that are not closed through the user logging out of an application are eventually closed.

Satisfies: SRG-APP-000295-AS-000263, SRG-APP-000389-AS-000253

Solution

Navigate to and open:

/usr/lib/vmware-lookupsvc/conf/web.xml

Navigate to the node and configure the as follows:

Restart the service with the following command:

vmon-cli --restart lookupsvc

See Also

https://workbench.cisecurity.org/benchmarks/23617

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-12, CAT|II, CCI|CCI-002361, CCI|CCI-004895, Rule-ID|SV-259049r1003620_rule, STIG-ID|VCLU-80-000070, Vuln-ID|V-259049

Plugin: Unix

Control ID: 9ede6671b2eedd12cc9aa607528e3f9747bbdea7a6b7f3f11908469ae1fcc462