0

Let's say the OS is Windows or Linux

As a System Admin, I think the answer to this question is : NO

I always configure end users machine for auto lockout for a given idle session time. Because I'm think, if the user leaves the machine without locking it, I should try something to at least protect my network

What if I did not do that ? Do you think there could be reasonable risk not related to a malicious person taking advantage of an idle session ?

As the command asked for clarification below

I'm talking about login session (ex : SSH, Windows OS, Linux OS)

  • 2
    I'm not sure about the context of your question. "session" is a very generic term and so is "idle session". Given that you talk about configuring end user machines you might refer to the login session on the machine, i.e. not about sessions in a web application, idle TCP sessions or any other kind of session which can be idle. Please clarify this both in title and question. – Steffen Ullrich Oct 17 at 13:45
  • @SteffenUllrich PLease see the update I'm talking about login session (SSH, Windows, Linux) When a user logs into a computer via Windows login screen or SSH for instance – steven miller Oct 17 at 16:38
0

There are many risks. The examples I am will be giving can be done even when the session is actively being used by the user.

First example involves a malware that first acts as a key logger, to catch a sudo credential, then it automatically starts to send keyboard strokes to the OS. These key board strokes involve commands being entered into the SSH console. Think of it as a rubber ducky attack with a key logger that does not involve a USB or removable media.

Another example involves an exploit with the SSH console software at the user end. This exploit would use a port other than the SSH port. An adversary that may know what SSH software (ex. PuTTY) is being used and send arbitrary data to that port. This arbitrary data would be an exploit that might cause unseen changes at first to the configuration of the SSH software.

| improve this answer | |
  • None of these issues are remedied by closing idle sessions. So I don't think this really addresses the question asked. – bitmask Oct 18 at 2:40
  • The first one can be remedied by closing an idle session. The malware does not necessarily have to be capable of opening up the terminal program. It may only be able to capture keystrokes, and type. The second example I can understand your concern. – Amol Soneji Oct 18 at 3:17
  • @AmolSoneji I agree with bitmask comment. The idea here to find out if the idle session in itself can be responsible of a high risk without a malicious user taking advantage of it. I also understand your point about the malware – steven miller 2 days ago

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.