2023-03-16 17:34:50 +00:00
|
|
|
id: configure-session-timeout
|
|
|
|
|
|
|
|
|
|
info:
|
|
|
|
|
name: Configure Sessions Timeout
|
|
|
|
|
author: pussycat0x
|
|
|
|
|
severity: info
|
|
|
|
|
description: |
|
|
|
|
|
Indefinite or even long session timeout window increase the risk of attackers abusing abandoned sessions.
|
|
|
|
|
reference: |
|
|
|
|
|
https://docs.netgate.com/pfsense/en/latest/config/advanced-admin.html
|
2023-03-22 19:14:02 +00:00
|
|
|
metadata:
|
|
|
|
|
verified: true
|
2023-03-16 17:34:50 +00:00
|
|
|
tags: firewall,config,audit,pfsense,file
|
|
|
|
|
|
|
|
|
|
file:
|
|
|
|
|
- extensions:
|
|
|
|
|
- xml
|
|
|
|
|
|
|
|
|
|
matchers-condition: and
|
|
|
|
|
matchers:
|
|
|
|
|
- type: word
|
|
|
|
|
words:
|
|
|
|
|
- "<session_timeout>"
|
|
|
|
|
- "<session_timeout>0</session_timeout>"
|
|
|
|
|
condition: or
|
|
|
|
|
negative: true
|
|
|
|
|
|
|
|
|
|
- type: word
|
|
|
|
|
words:
|
2023-03-22 19:01:22 +00:00
|
|
|
- "<pfsense>"
|
2023-03-16 17:34:50 +00:00
|
|
|
- "<webgui>"
|
2023-03-22 19:14:02 +00:00
|
|
|
- "<system>"
|
|
|
|
|
condition: and
|
