5.8 Ensure idle ESXi shell and SSH sessions time out after 300 seconds or less

Information

The ESXiShellInteractiveTimeOut allows you to automatically terminate idle ESXi shell and SSH sessions.
The permitted idle time should be 300 seconds or less.

*Rationale*

If a user forgets to log out of an ESXi shell or SSH session, the idle session will exist
indefinitely, increasing the potential for someone to gain unauthorized privileged access to
the host, unless a timeout is set.

Solution

To set the timeout to the desired value, perform the following from the vSphere web client:

1. Select the host.
2. Click "Configure" -> "System" -> "Advanced System Settings".
3. Type ESXiShellInteractiveTimeOut in the filter.
4. Click on the attribute to highlight it.
5. Click the pencil icon to edit.
6. Set the attribute to the desired value (300 seconds or less).
7. Click "OK".

Note: A value of 0 disables the ESXi ShellInteractiveTimeOut. Alternately, use the following PowerCLI command:

# Set Remove UserVars.ESXiShellInteractiveTimeOut to 300 on all hosts
Get-VMHost | Get-AdvancedSetting -Name 'UserVars.ESXiShellInteractiveTimeOut'
| Set-AdvancedSetting -Value "300"

See Also

https://workbench.cisecurity.org/files/2168

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-11, CSCv7|16.11

Plugin: VMware

Control ID: 9c5d440b7e4d1179e106c185f184b23fede5de030927aa4642739b8001e2c531