topic Oh, thanks for giving it a go in Network Security

ASA 5545 authentication timeout

dassey111 — Tue, 12 Mar 2019 08:40:20 GMT

I have a firewall DOD DISA STIG I need to apply. I have to set authentication timeout to 60 seconds.

Is there a way to set authentication timeouts? So if a user tries to SSH into the device and let it sit at the login screen for 60 seconds, reset/drop/close the session.

I have been looking for an AAA command to implement this, but no luck yet.

ASA 5545

ASA Version 9.4(3)

Try thisssh timeout 60

cofee — Fri, 16 Dec 2016 19:07:23 GMT

Try this:

ssh timeout 60 (this is in minutes, so you will be setting it for 1 minute and I am not sure but that might already be the default value)

This will be applied to the global config and set the timeout for any ssh connection on the firewall whether authenticated by radius/tacacs or local credentials.

Hi there, I believe the

nspasov — Sat, 17 Dec 2016 04:00:49 GMT

Hi there, I believe the command that you are looking for is:

console timeout 1

Here is the description of the command directly from the config guide:

Changing the Console Timeout Period

To change the console timeout period, or the duration of time the management console remains active before automatically shutting down, perform the following steps.

Detailed Steps


Command	Purpose
console timeoutnumber Example: hostname(config)# console timeout 0	Specifies the idle time in minutes (0 through 60) after which the console session ends. The default timeout is 0, which means the console session will not time out.

I hope this helps!

Thank you for rating helpful posts!

Oh, thanks for giving it a go

dassey111 — Mon, 19 Dec 2016 13:40:45 GMT

Oh, thanks for giving it a go. Good on you.

That is a good command if I want my session to last 1 minute in total time period. But, alas, I want the authentication time period to last less than 1 minute. Not the actual session.

The default value is 5

dassey111 — Mon, 19 Dec 2016 13:44:28 GMT

The default value is 5 minutes I believe.

So this is a great command and a great effort on your part. This will END the SESSION after X minutes of IDLE time.

And to be honest, I may have to use this command.

This should be CAT II NET1645

cofee — Mon, 19 Dec 2016 15:23:52 GMT

This should be CAT II NET1645 DISA STIG - This command will take care of it.