mediumaccess-controlunverified

Ensure systemd-logind logs out idle sessions

logind-idle-session-timeout · RHEL ≥ 9 · 1 impl

Description

systemd-logind must terminate idle login sessions after 10 minutes or less via StopIdleSessionSec in logind.conf. This is the logind-enforced timeout, distinct from the TMOUT shell variable (see shell-timeout).

Rationale

A logind-enforced idle timeout terminates unattended sessions regardless of the login shell, closing the gap left by shell-only TMOUT on non-interactive or non-bash sessions.

Check → Remediate

Checkcommand

val=$(systemd-analyze cat-config systemd/logind.conf 2>/dev/null |
  grep -E '^[[:space:]]*StopIdleSessionSec[[:space:]]*=' | tail -1 |
  sed 's/^[^=]*=[[:space:]]*//')
if [ -z "$val" ] || [ "$val" = "infinity" ]; then
  echo "FAIL: StopIdleSessionSec not configured"
  exit 1
fi
if [ "$val" -gt 0 ] 2>/dev/null && [ "$val" -le 600 ] 2>/dev/null; then
  echo "OK: StopIdleSessionSec=$val"
  exit 0
fi
echo "FAIL: StopIdleSessionSec=$val (must be 1..600)"
exit 1

expected_exit:: 0

Remediatemanual

note:: Set StopIdleSessionSec=600 under [Login] in /etc/systemd/logind.conf (or a drop-in), then: systemctl restart systemd-logind.

Framework references

STIG

V-258077 / RHEL-09-412080

NIST 800-53

AC-11AC-12

#logind#session#timeout#stig