← Back to Xylok Security Suite 20.x Security Technical Implementation Guide

V-269571

CAT II (Medium)

Xylok Security Suite must initiate a session lock after a 15-minute period of inactivity.

Rule ID

SV-269571r1055707_rule

STIG

Xylok Security Suite 20.x Security Technical Implementation Guide

Version

V1R2

CCIs

CCI-000057 CCI-001133

Discussion

A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system, but does not log out because of the temporary nature of the absence. The session lock is implemented at the point where session activity can be determined and/or controlled. This is handled at the operating system-level and results in a system lock. Satisfies: SRG-APP-000003, SRG-APP-000190

Check Content

Verify session is configured to lock after 15 minutes of inactivity. Execute the following:
$ grep SESSION_LENGTH /etc/xylok.conf

SESSION_LENGTH=900

If "SESSION_LENGTH" is set to more than 15 minutes or is missing, this is a finding. 

Note: The setting is in seconds. 900 seconds = 15 minutes

Fix Text

Set the session length:
1. As root, open /etc/xylok.conf in a text editor.

2. Add/Amend "SESSION_LENGTH=900" to the configuration file.

3. Restart Xylok to apply settings by executing the following:
    # systemctl restart xylok