AuthHound

RADIUS attribute 27 · type integer

Session-Timeout

Session-Timeout (attribute 27) is the number of seconds a session may last. With Termination-Action = RADIUS-Request it drives periodic reauthentication instead of disconnecting the user.

Also searched as: RADIUS reauth interval, Session-Timeout reauthentication. Defined in RFC 2865.

What it means

Session-Timeout caps a session's lifetime in seconds. What happens at the end depends on Termination-Action (attribute 29): the default (0) disconnects the device, while RADIUS-Request (1) makes the NAS silently reauthenticate. That pairing is how you enforce a guest time limit (disconnect) versus a rolling reauth for posture or credential re-checks (reauthenticate).

How it's used

Return it in the Access-Accept as an integer number of seconds. Add Termination-Action = 1 for transparent reauth; omit it (or set 0) for a hard cut-off.

Common gotchas

  • Without Termination-Action = 1, a Session-Timeout drops the user at the interval — a "Wi-Fi disconnects every N minutes" complaint that looks like a signal problem but is really a policy setting.

Prove what the server actually returned: the open-source authhound-probe prints every authorization attribute in the Access-Accept and asserts the one you care about — a silently ignored attribute becomes a hard FAIL. 

export AUTHHOUND_RADIUS_SECRET='shared-secret'   # not in argv or shell history
authhound-probe radius test --server radius.corp.com --peap alice --expect-attr Filter-Id=staff

Recipe: assert returned attributes with --expect-vlan / --expect-attr

Seeing this attribute in a reject or an accept that behaves wrong? Paste the full log into the analyzer — it runs in your browser, nothing is uploaded, and it ranks the likely causes for your specific output.

Related

When a NAS quietly stops honoring an attribute across a fleet, nobody sees it until users complain. AuthHound is building monitoring that tracks the attributes your servers actually return — early access:

No spam, no sharing — one email when it's ready, and you can reply to be removed anytime.