STIGQter: STIG Summary: F5 BIG-IP TMOS NDM Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 02 Jul 2025:

The F5 BIG-IP appliance must set the idle time before automatic logout to five minutes of inactivity except to fulfill documented and validated mission requirements.

DISA Rule

SV-266095r1024904_rule

Vulnerability Number

V-266095

Group Title

SRG-APP-000190-NDM-000267

Rule Version

F5BI-DM-300057

Severity

CAT I

CCI(s)

• CCI-001133 - Terminate the network connection associated with a communications session at the end of the session or after an organization-defined time period of inactivity.
• CCI-000057 - The information system initiates a session lock after the organization-defined time period of inactivity.

Weight

10

Fix Recommendation

From the BIG-IP GUI:
HTTPD/TMSH:
1. System.
2. Preferences.
3. Under Security Settings configure "Idle Time Before Automatic Logout" to 300 seconds.
4. Click "Update".

SSHD:
1. System.
2. Configuration.
3. Device.
4. SSHD.
5. Configure "Idle Time Before Automatic Logout" to 300 seconds.
6. Click "Update".

From the BIG-IP Console, issue the following commands:
HTTPD/TMSH:
tmsh modify sys httpd auth-pam-idle-timeout 300

tmsh modify sys httpd auth-pam-dashboard-timeout on

tmsh modify sys global-settings console-inactivity-timeout 300

tmsh modify cli global-settings idle-timeout 5

SSHD:
tmsh modify sys sshd inactivity-timeout 300

tmsh save sys config

Check Contents

If a documented and validated reason for not implementing the five-minute idle timeout exists, this is not a finding.

From the BIG-IP GUI:
HTTPD/TMSH:
1. System.
2. Preferences.
3. Under Security Settings, verify "Idle Time Before Automatic Logout" is configured for 300 seconds or less.

SSHD:
1. System.
2. Configuration.
3. Device.
4. SSHD.
5. Verify "Idle Time Before Automatic Logout" is configured for 300 seconds or less.

From the BIG-IP Console, issue the following commands:
HTTPD/TMSH:

tmsh list sys httpd auth-pam-idle-timeout
Note: This must return a value of 300 or less.

tmsh list sys httpd auth-pam-dashboard-timeout
Note: This must return a value of "on".

tmsh list sys global-settings console-inactivity-timeout
Note: This must return a value of 300 or less.

tmsh list cli global-settings idle-timeout
Note: This must return a value of 5.

SSHD:
tmsh list sys sshd inactivity-timeout
Note: This must return a value of 300 or less.

If the BIG-IP appliance is not configured to terminate inactive sessions after five minutes of inactivity, this is a finding.

Vulnerability Number

V-266095

Documentable

False

Rule Version

F5BI-DM-300057

Severity Override Guidance

If a documented and validated reason for not implementing the five-minute idle timeout exists, this is not a finding.

From the BIG-IP GUI:
HTTPD/TMSH:
1. System.
2. Preferences.
3. Under Security Settings, verify "Idle Time Before Automatic Logout" is configured for 300 seconds or less.

SSHD:
1. System.
2. Configuration.
3. Device.
4. SSHD.
5. Verify "Idle Time Before Automatic Logout" is configured for 300 seconds or less.

From the BIG-IP Console, issue the following commands:
HTTPD/TMSH:

tmsh list sys httpd auth-pam-idle-timeout
Note: This must return a value of 300 or less.

tmsh list sys httpd auth-pam-dashboard-timeout
Note: This must return a value of "on".

tmsh list sys global-settings console-inactivity-timeout
Note: This must return a value of 300 or less.

tmsh list cli global-settings idle-timeout
Note: This must return a value of 5.

SSHD:
tmsh list sys sshd inactivity-timeout
Note: This must return a value of 300 or less.

If the BIG-IP appliance is not configured to terminate inactive sessions after five minutes of inactivity, this is a finding.

Check Content Reference

M

Target Key

5639