Ensure default user shell timeout is configured

MediumLevel 1Automatedlinux

Description

TMOUT is an environmental setting that determines the timeout of a shell in seconds. • TMOUT=n - Sets the shell timeout to n seconds. A setting of TMOUT=0 disables timeout. • readonly TMOUT- Sets the TMOUT environmental variable as readonly, preventing unwanted modification during run-time. • export TMOUT - exports the TMOUT variable System Wide Shell Configuration Files: • /etc/profile - used to set system wide environmental variables on users shells. The variables are sometimes the same ones that are in the .bash_profile, however this file is used to set an initial PATH or PS1 for all shell

How it is checked

Audit method: Shell command

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash

{
   a_output=(); a_output2=(); l_tmout_set="900"
   f_tmout_read_chk()
   {
      a_out=(); a_out2=()
      l_tmout_readonly="$(grep -P -- '"'"'^\h*(typeset\h\- xr\hTMOUT=\d+|([^#\n\r]+)?\breadonly\h+TMOUT\b)'"'"' "$l_file")"
      l_tmout_export="$(grep -P -- '"'"'^\h*(typeset\h\- xr\hTMOUT=\d+|([^#\n\r]+)?\bexport\b([^#\n\r]+\b)?TMOUT\b)'"'"' "$l_file")"
      if [ -n "$l_tmout_readonly" ]; then
         a_out+=("  - Readonly is set as: \"$l_tmout_readonly\" in: \"$l_file\"")
      else
         a_out2+=("  - Readonly is not set in: \"$l_file\"")
      fi
      if [ -n "$l_tmout_export" ]; then
         a_out+=("  - Export is set as: \"$l_tmout_export\" in: \"$l_file\"")
      else
         a_out2+=("  - Export is not set in: \"$l_file\"")
      fi
   }
   while IFS= read -r l_file; do
      l_tmout_value="$(grep -Po -- '"'"'^([^#\n\r]+)?\bTMOUT=\d+\b'"'"' "$l_file" | awk -F= '"'"'{print $2}'"'"')"
      f_tmout_read_chk
      if [ -n "$l_tmout_value" ]; then
         if [[ "$l_tmout_value" -le "$l_tmout_set" && "$l_tmout_value" -gt "0" ]]; then
            a_output+=(" - TMOUT is set to: \"$l_tmout_value\" in: \"$l_file\"")
            [ "${#a_out[@]}" -gt 0 ] && a_output+=("${a_out[@]}")
            [ "${#a_out2[@]}" -gt 0 ] && a_output2+=("${a_out[@]}")
         fi
         if [[ "$l_tmout_value" -gt "$l_tmout_set" || "$l_tmout_value" -le "0" ]]; then
            a_output2+=(" - TMOUT is incorrectly set to: \"$l_tmout_value\" in: \"$l_file\"")
            [ "${#a_out[@]}" -gt 0 ] && a_output2+=("  ** Incorrect TMOUT value **" "${a_out[@]}")
            [ "${#a_out2[@]}" -gt 0 ] && a_output2+=("${a_out2[@]}")
         fi
      else
         [ "${#a_out[@]}" -gt 0 ] &&  a_output2+=(" - TMOUT is not set" "${a_out[@]}")
         [ "${#a_out2[@]}" -gt 0 ] &&  a_output2+=(" - TMOUT is not set" "${a_out2[@]}")
      fi
   done < <(grep -Pls -- '"'"'^([^#\n\r]+)?\bTMOUT\b'"'"' /etc/*bashrc /etc/profile /etc/profile.d/*.sh)
   [[ "${#a_output[@]}" -le 0 && "${#a_output2[@]}" -le 0 ]] && a_output2+=(" - TMOUT is not configured")
   if [ "${#a_output2[@]}" -le 0 ]; then
      printf '"'"'%s\n'"'"' "" "- Audit Result:" "  ** PASS **" "${a_output[@]}"
   else
      printf '"'"'%s\n'"'"' "" "- Audit Result:" "  ** FAIL **" "  * Reasons for audit failure *" "${a_output2[@]}" ""
      [ "${#a_output[@]}" -gt 0 ] && printf '"'"'%s\n'"'"' "- Correctly set:" "${a_output[@]}"
   fi
}' 2>&1); printf '%s\n' "$o" | grep -q '\*\* PASS \*\*' || { echo "step1: script did not report PASS"; return 1; }; }; if alt0; then echo compliant; fi

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Review /etc/bashrc, /etc/profile, and all files ending in *.sh in the /etc/profile.d/ directory and remove or edit all TMOUT=_n_ entries to follow local site policy. TMOUT should not exceed 900 or be equal to 0. Configure TMOUT in one of the following files: • A file in the /etc/profile.d/ directory ending in .sh • /etc/profile • /etc/bashrc Example command to set TMOUT to 900 seconds in a file in /etc/profile.d/: # printf '%s\n' "# Set TMOUT to 900 seconds" "typeset -xr TMOUT=900" > /etc/profile.d/50-tmout.sh TMOUT configuration examples: typeset -xr TMOUT=900 Deprecated methods: • As multiple lines: TMOUT=900 readonly TMOUT export TMOUT • As a single line: readonly TMOUT=900 ; export TMOUT

Properties

Operating systems: rocky-8
Tags: cis-convertedlinux
Reference: CIS Rocky Linux 8 Benchmark v3.0.0 - 5.4.3.2

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target linux