1.2.3 Set 'seconds' for 'ssh timeout' for 60 seconds or less

Information

The time interval that the router waits for the SSH client to respond before disconnecting an uncompleted login attempt.

This reduces the risk of an administrator leaving an authenticated session logged in for an extended period of time.

Solution

Configure the SSH timeout

IOSXR(config)#ssh timeout {ssh_timeout}

Impact:

Organizations should implement a security policy requiring minimum timeout settings for all network administrators and enforce the policy through the 'ip ssh timeout' command.

See Also

https://workbench.cisecurity.org/benchmarks/10473

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2(1), CSCv7|4.5

Plugin: Cisco

Control ID: af3c23820d1331f7760702d96cad7b278d41fbb6327761aa17a25fd31dfcdede