Apache (or any other HTTP daemon) has nothing to do with sessions expiring; that's an issue to be handled between the client and PHP.
For the client side of things, you need to make sure the session ID is being propagated from one page request to another for as long as you desire a single session to be valid (or "not timed out"). If you're using cookies to propagate this ID value, then a relevant PHP directive to consider would be session.cookie_lifetime.
For the PHP side of things, you need to make sure that PHP's garbage collector (or "gc" for short) when randomly invoked won't consider session data as stale/expired (or "not timed out") if it hasn't been accessed for a period of time that doesn't exceed whatever you'd like to be considered as being "too old." The relevant PHP directive in this case would be session.gc_maxlifetime.