Detections
Analytics

5.4.3.2 Ensure default user shell timeout is configured

Information

TMOUT is a shell environment variable that sets an interactive shell's idle timeout, in seconds: after TMOUT seconds with no input, the shell exits. TMOUT=<n> sets the timeout to n seconds (a value of 0 disables it); marking the variable readonly prevents a user from overriding it during the session, and export ing it applies it to the user's shell environment.

Setting a timeout value reduces the window of opportunity for unauthorized user access to another user's shell session that has been left unattended. It also ends the inactive session and releases the resources associated with that session.

Solution

Configure TMOUT in a single file. Because best practice marks TMOUT readonly, a second assignment from a later-sourced file produces a "TMOUT: readonly variable" error at every login, so it must be set exactly once.

 - Run the following command to locate any existing TMOUT assignments in the shell initialization files:

# grep -PHrs -- '\bTMOUT\b' /etc/profile /etc/profile.d/ /etc/bashrc /etc/*bashrc

 -

In each file returned in step one, remove or comment out the TMOUT lines so TMOUT is no longer set in more than one location.

 -

Create a single drop-in file in /etc/profile.d/ that sets, marks readonly, and exports TMOUT in one statement, using a value greater than 0 and no greater than 900 seconds in line with local site policy.

Example:

# printf '%s\n' "# Set a 900 second interactive shell timeout" "typeset -xr TMOUT=900" > /etc/profile.d/50-tmout.sh

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(5), 800-53|AC-11, 800-53|AC-11(1), 800-53|AC-12, CSCv7|16.11

Plugin: Unix

Control ID: e05089fd7aa8d2878b95df05a2d65f1dbf5d0ad95d0ae9a3dfc34e114efe513f