PAM client and access sessions time out despite activity in sessions

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

PAM users launch RDP or SSH access sessions and actively work on them. But despite the ongoing activity in the access sessions, the PAM client session times out and the connections to the target devices get disconnected X minutes after the last session was launched, where X is the configured Login Timeout setting on the Settings > Global Settings > Basic Settings page.

While the session is active, the Timeout column on the Sessions > Manage Sessions page is empty, which is expected for sessions with active target device connections. The login session should not time out while connections are active.

Environment

4.2.0-4.2.2

Cause

In the 4.2.0 release this is observed when the Login Timeout setting is equal to or larger than the Connection Idle Timeout setting. Both settings are configured on the Settings > Global Settings > Basic Settings page.

The PAM 4.2.1 release includes a fix for the case where the Login Timeout setting equals the Connection Idle Timeout setting, but the problem persists if the Login Timeout value is larger.

Resolution

You can avoid the problem by configuring the Connection Idle Timeout to be larger than the Login Timeout. E.g. if you are running 4.2.0 and started out with 60 minutes for both settings, reduce the login timeout to 59 minutes, or increase the Connection Idle Timeout to 61 minutes. If you prefer to keep the timeout settings the same, upgrade to 4.2.1+.

If you are forced to keep the Login Timeout setting larger than the Connection Idle Timeout setting, ask your users to touch the PAM client session every once in a while, within the Login Timeout setting, such as by setting or changing a device name filter on the access page.

Additional Information

As of April 2025 a defect is open with PAM Engineering to get the problem fixed in future releases.