SV-258068r1101950: RHEL 9 must automatically exit interactive command shell user sessions after 10 minutes of inactivity. | Red Hat Enterprise Linux 9 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

RHEL 9 must automatically exit interactive command shell user sessions after 10 minutes of inactivity.

Description

Discussion Text

Terminating an idle interactive command shell user session within a short time period reduces the window of opportunity for unauthorized personnel to take control of it when left unattended in a virtual terminal or physical console. Satisfies: SRG-OS-000163-GPOS-00072, SRG-OS-000029-GPOS-00010

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000057Not mappedCCI-001133

References

DPMS Target Red Hat Enterprise Linux 9 DISA DPMS Target Red Hat Enterprise Linux 9 5551

Checks

DISA STIG (Manual Reference)

Verify RHEL 9 is configured to exit interactive command shell user sessions after 10 minutes of inactivity or less with the following command:

$ sudo grep -i tmout /etc/profile /etc/profile.d/*.sh

/etc/profile.d/tmout.sh:declare -xr TMOUT=600

If "TMOUT" is not set to "600" or less in a script located in the "/etc/'profile.d/ directory, is missing or is commented out, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.rhel9os:def:258068
# RHEL 9 must automatically exit interactive command shell user sessions after 10 minutes of inactivity.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# TMOUT is set to 600 or less in /etc/profile and /etc/profile.d/*.sh
# textfilecontent54_object (textfilecontent54_test)
test_1() {
  ( [ "$(sed -En 's/^[^#]*\s*TMOUT=(\d+)\s*$/\1/p' '/etc/profile')" -le 600 ] ) || ( [ "$(grep -rhP --include='*.sh' '^[^#]*\s*TMOUT=(\d+)\s*$' '/etc/profile.d' | sed -En 's/^[^#]*\s*TMOUT=(\d+)\s*$/\1/p')" -le 600 ] )
}

if test_1; then
  echo "PASS"
else
  echo "FAIL"
fi

Remediation

Configure RHEL 9 to exit interactive command shell user sessions after 10 minutes of inactivity.

Add or edit the following line in "/etc/profile.d/tmout.sh":

#!/bin/bash

declare -xr TMOUT=600