← Back to VMware Horizon 7.13 Connection Server Security Technical Implementation Guide

V-246894

CAT II (Medium)

The Horizon Connection Server must time out administrative sessions after 15 minutes or less.

Rule ID

SV-246894r879637_rule

STIG

VMware Horizon 7.13 Connection Server Security Technical Implementation Guide

Version

V1R2

CCIs

CCI-001185

Discussion

If communications sessions remain open for extended periods of time even when unused, there is the potential for an adversary to hijack the session and use it to gain access to the system. Horizon 7 Console sessions can and must be limited in the amount of idle time that will be allowed before automatic logoff. By default, 30 minutes of idle time is allowed but this must be changed to 15 minutes or less for DoD systems. This configuration must be verified and maintained over time. Satisfies: SRG-APP-000220-AS-000148, SRG-APP-000295-AS-000263, SRG-APP-000389-AS-000253

Check Content

Log in to the Horizon 7 Console. From the left pane, navigate to Settings >> Global Settings. In the right pane, click the "General Settings" tab. Find the “Connection Server Session Timeout” value.

If "Connection Server Session Timeout" is set to more than 15 minutes, this is a finding.

Fix Text

Log in to the Horizon 7 Console. From the left pane, navigate to Settings >> Global Settings. In the right pane, click the "General Settings" tab. Click "Edit". Set "Connection Server Session Timeout" to "15" minutes (or less). Click "OK".