NimbostratusWe are using LTM/APM 11.5.1 and would like to be able to get all the session ids for a particular user and kill them (or at least dead-end their traffic). I know we can do this via the GUI but am looking for ways this can be automated if it is detected the account is compromised. Is it possible via REST?
NimbostratusHow about eliminate this issue, by restricting the users to limited sessions using "Max Sessions Per User"?
On cli
sessiondump -allkeysAn extreme option is to delete all sessions something like:
sessiondump -list | awk '{ print $1}' | xargs -L 1 sessiondump -delete'
NimbostratusLimiting the max number of sessions per user wouldn't help in the situation where a user account has been compromised and being used by an unauthorised third party.
We do not wish to kill all sessions and ideally I'm looking for a solution where I can give the operations team a script to run which just requires a username input and the specified user's sessions will be killed.
NimbostratusA shell script like following:
sessiondump -allkeys | grep $1 | cut -d. -f1 | xargs -L 1 sessiondump -delete.. and call like
./removeUser.sh user1