mediumaccess-controlverified ✓

Terminate idle shell sessions with a TMOUT timeout

shell-idle-timeout-tmout · UBUNTU ≥ 22 · 1 impl

Description

Interactive shell sessions must automatically terminate after a period of inactivity by setting a positive TMOUT value in the shell startup files (/etc/bash.bashrc, /etc/profile, or /etc/profile.d/). A value of 0, an unset TMOUT, or a commented-out entry does not enforce a timeout.

Rationale

An unattended interactive session left logged in is an open door for anyone with physical or hijacked access to the terminal. Automatically terminating idle shells bounds that exposure window and enforces re-authentication.

Check → Remediate

Checkcommand

grep -rhE '^[[:space:]]*(export[[:space:]]+|readonly[[:space:]]+)?TMOUT=[1-9][0-9]*([[:space:]]|;|$)' /etc/bash.bashrc /etc/profile /etc/profile.d/ 2>/dev/null | grep -q .

expected_exit:: 0

Remediatemanual

note:: Create /etc/profile.d/99-terminal_tmout.sh containing a positive timeout, e.g. TMOUT=600 (10 minutes), and ensure it is not overridden or commented out.

Framework references

STIG

V-270680 / UBTU-24-200060V-260554 / UBTU-22-412030

NIST 800-53

AC-11AC-12

Live verification

ubuntu22:checkubuntu24:check

#session#timeout#tmout#shell#stig