Detections
Analytics

1.13 VCPF-80-000070

Information

The vCenter Perfcharts service must set an inactive timeout for sessions.

GROUP ID: V-259083RULE ID: SV-259083r1003623

Leaving sessions open indefinitely is a major security risk. An attacker can easily use an already authenticated session to access the hosted application as the previously authenticated user. By closing sessions after a set period of inactivity, the web server can make certain that those sessions that are not closed through the user logging out of an application are eventually closed.

Satisfies: SRG-APP-000295-AS-000263, SRG-APP-000389-AS-000253

Solution

Navigate to and open:

/usr/lib/vmware-perfcharts/tc-instance/webapps/statsreport/WEB-INF/web.xml

Navigate to the node and configure the as follows:

Restart the service with the following command:

vmon-cli --restart perfcharts

See Also

https://workbench.cisecurity.org/benchmarks/23627

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-12, CAT|II, CCI|CCI-002361, CCI|CCI-004895, Rule-ID|SV-259083r1003623_rule, STIG-ID|VCPF-80-000070, Vuln-ID|V-259083

Plugin: Unix

Control ID: 36f5a40695b94b95980f9f5c60bd6e7daec7511ab55b845d303785b7f087b0ea