STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must terminate all network connections associated with a communications session at the end of the session, or as follows: for in-band management sessions (privileged sessions), the session must be terminated after 10 minutes of inactivity.

DISA Rule

SV-257544r1015796_rule

Vulnerability Number

V-257544

Group Title

SRG-APP-000190-CTR-000500

Rule Version

CNTR-OS-000490

Severity

CAT II

CCI(s)

• CCI-001133 - Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.
• CCI-004895 - Permit users to invoke the trusted communications path for communications between the user and the organization-defined security functions, including at a minimum, authentication and re-authentication.

Weight

10

Fix Recommendation

Download the latest version of the OC client, and remove/replace any older versions.

For each oauth client that does not have the idle timeout set, or the timeout is set to the wrong duration, run the following command to set the idle timeout value to 10 minutes.

oc patch oauthclient/<CLIENT_NAME> --type=merge -p '{"accessTokenInactivityTimeoutSeconds":600}'

where CLIENT_NAME is the name of the oauthclient identified in the check.

Check Contents

On each administrators terminal, verify the OC client version includes the required idle timeout by executing the following.

oc version

If the client version < "4.8.36", this is a finding.

Determine if the session token inactivity timeout is set on the oauthclients by executing the following:

oc get oauthclients -ojsonpath='{range .items[*]}{.metadata.name}{"\t"}{.accessTokenInactivityTimeoutSeconds}{"\n"}'

The output will list each oauth client name followed by a number. The number represents the timeout in seconds. If no number is displayed, or the timeout value is >600, this is a finding.

Vulnerability Number

V-257544

Documentable

False

Rule Version

CNTR-OS-000490

Severity Override Guidance

On each administrators terminal, verify the OC client version includes the required idle timeout by executing the following.

oc version

If the client version < "4.8.36", this is a finding.

Determine if the session token inactivity timeout is set on the oauthclients by executing the following:

oc get oauthclients -ojsonpath='{range .items[*]}{.metadata.name}{"\t"}{.accessTokenInactivityTimeoutSeconds}{"\n"}'

The output will list each oauth client name followed by a number. The number represents the timeout in seconds. If no number is displayed, or the timeout value is >600, this is a finding.

Check Content Reference

M

Target Key

5547