AC-12 Session Termination
All changes in this version
Title
Session Termination
Control
Automatically terminate a user session after [Assignment: conditions or trigger events].
Discussion
Session termination addresses the termination of user-initiated logical sessions (in contrast to [SC-10](#sc-10) , which addresses the termination of network connections associated with communications sessions (i.e., network disconnect)). A logical session (for local, network, and remote access) is initiated whenever a user (or process acting on behalf of a user) accesses an organizational system. Such user sessions can be terminated without terminating network sessions. Session termination ends all processes associated with a user’s logical session except for those processes that are specifically created by the user (i.e., session owner) to continue after the session is terminated. Conditions or trigger events that require automatic termination of the session include organization-defined periods of user inactivity, targeted responses to certain types of incidents, or time-of-day restrictions on system use.
Parameters
ac-12_odp: conditions or trigger events
Related controls
ma-4, sc-10, sc-23
Assessment objective
AC-12 a user session is automatically terminated after [Assignment: conditions or trigger events].
STIG rules that implement this control 20
Apple macOS 15 (Sequoia) V1R8
- APPL-15-000120 CAT II The macOS system must configure SSHD channel timeout to 900.
- APPL-15-000130 CAT II The macOS system must configure SSHD unused connection timeout to 900.
- APPL-15-000160 CAT II The macOS system must enforce auto logout after 86400 seconds of inactivity.
Apple macOS 26 (Tahoe) V1R4
- APPL-26-000120 CAT II The macOS system must configure SSHD channel timeout to 900.
- APPL-26-000130 CAT II The macOS system must configure SSHD unused connection timeout to 900.
- APPL-26-000160 CAT II The macOS system must enforce auto logout after 86400 seconds of inactivity.
Application Security and Development V6R5
- APSC-DV-000060 CAT II The application must clear temporary storage and cookies when the session is terminated.
- APSC-DV-000070 CAT II The application must automatically terminate the non-privileged user session and log off non-privileged users after a 15 minute idle time period has elapsed.
- APSC-DV-000080 CAT II The application must automatically terminate the admin user session and log off admin users after a 10 minute idle time period is exceeded.
Canonical Ubuntu 22.04 LTS V2R10
- UBTU-22-412030 CAT II Ubuntu 22.04 LTS must automatically exit interactive command shell user sessions after 15 minutes of inactivity.
Canonical Ubuntu 24.04 LTS V1R7
- UBTU-24-200060 CAT II Ubuntu 24.04 LTS must automatically terminate a user session after inactivity timeouts have expired.
Microsoft Windows 11 V2R11
- WN11-SO-000070 CAT II The machine inactivity limit must be set to 15 minutes, locking the system with the screensaver.
Microsoft Windows Server 2022 V2R11
- WN22-DC-000160 CAT III Windows Server 2022 directory service must be configured to terminate LDAP-based network connections to the directory server after five minutes of inactivity.
Microsoft Windows Server 2025 V1R4
- WN25-DC-000160 CAT III Windows Server 2025 directory service must be configured to terminate LDAP-based network connections to the directory server after five minutes of inactivity.
- WN25-SH-000060 CAT II Windows Server 2025 OpenSSH must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive.
- WN25-SH-000070 CAT II Windows Server 2025 OpenSSH must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive.
Red Hat Enterprise Linux 10 V1R3
- RHEL-10-700660 CAT II RHEL 10 must be configured so that all network connections associated with Secure Shell (SSH) traffic terminate after becoming unresponsive.
- RHEL-10-700930 CAT II RHEL 10 must be configured with a timeout interval for the Secure Shell (SSH) daemon.
Red Hat Enterprise Linux 9 V2R10
- RHEL-09-255095 CAT II RHEL 9 must be configured so that all network connections associated with SSH traffic terminate after becoming unresponsive.
- RHEL-09-255100 CAT II RHEL 9 must be configured so that all network connections associated with SSH traffic are terminated after 10 minutes of becoming unresponsive.