How To Change Session Time Out In Apache?

Two different timeouts being discussed here. Session timeout is the php session that andrew and others mention above. TCP etc is a connection timeout.

The hijacking I think would refer to session hijacking where someone grabs your php session token, which is being used for authentication, over an unencrypted connection. Although TCP/IP injection attacks are possible, not sure this is what was being asked.

/etc/httpd/conf/extra/htt 2.2/conf/extra/httpd-defa

The timeout you're referring to is in PHP.ini

i think the config change your after is session.gc_maxlifetime in the php.ini. this setting will remove the session when the timeout is hit.

therefore if a client remains idle for too long their session will be cleaned on the server. when they attempt access the server after the cleanup they will (if coded correctly) be unable to continue, typically then taken back to the login screen.

you can also use unique session cookies with ssl encryption

an attacker can hijack a web browser session more easily if the web server is not configured properly for session time-outs. for this reason, web applications and server are usually configured to time out after a specific period of inactivity. this is called TCP/IP highjacking

if the web server time-out settins is too long, the attacker obtains enought time to use a compromised cookie or guess a session ID to hijack the session

attackers can use TCP/IP hijacking to attack clear-text connetions, such as telnet. attackers can hijack a telnet session by suing a man-in-the-middle attack.

for this, attackers monitor a telnet session and intercept data being transferred from a client to a server. attackers can use the intercepted information to take control of the session for transferring forge data packets.

the questions is how can you prevent TCP/IP hijacking?

you can require a user to reauthenticate before transfering sensitive information this reduces the risk of an attacker taking control of a user session.

i think TCP timeouts overule apache timeouts,, if you are trying to make your web server more secured, make sure to you confirm you TCP settings also