Rule ID
SV-286209r1292154_rule
Version
V1R1
CCIs
This addresses the termination of user-initiated logical sessions in contrast to the termination of network connections that are associated with communications sessions (i.e., network disconnect). A logical session (for local, network, and remote access) is initiated whenever a user (or process acting on behalf of a user) accesses an organizational information system. Such user sessions can be terminated (and thus terminate user access) without terminating network sessions. Session termination ends all processes associated with a user s logical session except those batch processes/jobs that are specifically created by the user (i.e., session owner) to continue after the session is terminated. Conditions or trigger events requiring automatic session termination can include, for example, organization-defined periods of user inactivity, targeted responses to certain types of incidents, and time-of-day restrictions on information system use. This capability is typically reserved for specific cases where the system owner, data owner, or organization requires additional assurance.
Log in to MariaDB and run as the DBA: SHOW GLOBAL VARIABLES LIKE 'interactive_timeout'; SHOW GLOBAL VARIABLES LIKE 'wait_timeout'; Review the configured timeout values. If granular timeout controls for idle transactions are required, run: SHOW GLOBAL VARIABLES LIKE 'idle_transaction_timeout'; SHOW GLOBAL VARIABLES LIKE 'idle_write_transaction_timeout'; SHOW GLOBAL VARIABLES LIKE 'idle_readonly_transaction_timeout'; If idle session termination is required and the timeout values exceed the approved inactivity threshold or are disabled, this is a finding.
Configure MariaDB to automatically terminate user sessions based on organization-defined security procedures regarding conditions or trigger events that require session termination. Session termination behavior can be controlled through timeout configuration variables. Review the current timeout configuration values using the following command: SHOW GLOBAL VARIABLES LIKE '%timeout%'; The following timeout variables may be configured to enforce automatic termination of inactive sessions or transactions: interactive_timeout wait_timeout idle_transaction_timeout idle_write_transaction_timeout idle_readonly_transaction_timeout To modify these values, run the appropriate command as the DBA. Locate the MariaDB Enterprise Server configuration file to change. For CentOS, Red Hat, and similar distributions, this will be in "/etc/my.cnf.d/". In the [mariadb] section, add the lines: interactive_timeout = value wait_timeout = value idle_transaction_timeout = value idle_write_transaction_timeout = value idle_readonly_transaction_timeout = value Session-specific timeout values may also be set within application code or database sessions. For example: SET SESSION idle_transaction_timeout = 2; Example test sequence: BEGIN; SELECT * FROM t; (wait several seconds) SELECT * FROM t; If the configured timeout is exceeded, the session will terminate and return an error indicating the connection has been closed. For more information refer to https://mariadb.com/kb/en/library/transaction-timeouts/.