Detections
Analytics
5.4.3.2 Ensure default user shell timeout is configured
Information
TMOUT is an environmental setting that determines the timeout of a shell in seconds.- TMOUT=n - Sets the shell timeout to n seconds. A setting of TMOUT=0 disables timeout.
- readonly TMOUT- Sets the TMOUT environmental variable as readonly, preventing unwanted modification during run-time.
- export TMOUT - exports the TMOUT variable
System Wide Shell Configuration Files: There are several configuration files where system wide environmental variables may be configured for users' shells. It is recommended to place your configuration in a shell script within /etc/profile.d to set your own system wide environmental variables.
Setting a timeout value reduces the window of opportunity for unauthorized user access to another user's shell session that has been left unattended. It also ends the inactive session and releases the resources associated with that session.
Solution
Review /etc/bashrc, /etc/profile, and all files ending in *.sh in the /etc/profile.d/ and /usr/etc/profile.d/ directories and remove or edit all TMOUT=_n_ entries to follow local site policy. TMOUT should not exceed 900 or be equal to 0.Configure TMOUT in one of the following files:
- A file in the /etc/profile.d/ directory ending in .sh
- /etc/profile
- /etc/bashrc
Example command to set TMOUT to 900 seconds in a file in /etc/profile.d/ :
# printf '%s\n' "# Set TMOUT to 900 seconds" "typeset -xr TMOUT=900" > /etc/profile.d/50-tmout.sh
TMOUT configuration examples:
typeset -xr TMOUT=900
Deprecated methods:
- As multiple lines:
TMOUT=900
readonly TMOUT
export TMOUT
- As a single line:
readonly TMOUT=900 ; export TMOUT
See Also
Item Details
Category: ACCESS CONTROL
References: 800-53|AC-2(5), 800-53|AC-11, 800-53|AC-11(1), 800-53|AC-12, CSCv7|16.11
Plugin: Unix
Control ID: 8bf067b6e290550d477dc5c212781a5cc7b4ea9319ec8468855aeb06ce489a09