mediumaccess-controlunverified

Ensure interactive shells time out after 10 minutes of inactivity

shell-timeout-600 · RHEL ≥ 8 · 1 impl

Description

A TMOUT value of 600 seconds (or less, but non-zero) must be configured in /etc/profile or an /etc/profile.d/*.sh script so idle interactive shell sessions are terminated automatically.

Rationale

An unattended, still-authenticated shell is an open door for anyone with physical or session access. Terminating idle shells after 10 minutes bounds that exposure.

Check → Remediate

Checkcommand

# Smallest TMOUT= value across /etc/profile and /etc/profile.d/*.sh.
val=$(grep -hE '^[[:space:]]*(declare[[:space:]]+-[a-zA-Z]+[[:space:]]+|readonly[[:space:]]+|export[[:space:]]+|typeset[[:space:]]+-[a-zA-Z]+[[:space:]]+)?TMOUT=' \
        /etc/profile /etc/profile.d/*.sh 2>/dev/null \
        | grep -oE 'TMOUT=[0-9]+' | cut -d= -f2 | sort -n | head -1)
if [ -z "$val" ]; then
  echo "FAIL: no TMOUT set in /etc/profile or /etc/profile.d/*.sh"
  exit 1
fi
if [ "$val" -gt 0 ] && [ "$val" -le 600 ]; then
  echo "OK: TMOUT=$val (<= 600, non-zero)"
  exit 0
fi
echo "FAIL: TMOUT=$val (must be 1-600)"
exit 1

expected_exit:: 0

Remediateconfig_set

path:: /etc/profile.d/tmout.sh
key:: typeset -xr TMOUT
value:: 600
separator:: =

Framework references

STIG

V-281295 / RHEL-10-700920V-279929 / RHEL-08-020360

NIST 800-53

SC-10AC-12

#session#timeout#tmout#hardening#stig