The Central Log Server must provide a logout capability for user initiated communication session.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-221923 | SRG-APP-000296-AU-000560 | SV-221923r961224_rule | CCI-002363 | medium |
| Description | ||||
| If a user cannot explicitly end an application session, the session may remain open and be exploited by an attacker; this is referred to as a zombie session. Information resources to which users gain access via authentication include, for example, local workstations, databases, and password-protected websites/web-based services. However, for some types of interactive sessions including, for example, file transfer protocol (FTP) sessions, information systems typically send logout messages as final messages prior to terminating sessions. | ||||
| STIG | Date | |||
| Central Log Server Security Requirements Guide | 2024-12-04 | |||
Details
Check Text (C-221923r961224_chk)
Examine the configuration.
Verify that the Central Log Server provides a logout capability for user initiated sessions.
If the Central Log Server does not provide a logout capability for user initiated sessions, this is a finding.
Fix Text (F-23627r420112_fix)
Configure the Central Log Server to provide a logout capability for user initiated sessions.