Ensure default user shell timeout is configured

中レベル 1自動linux

説明

TMOUT is a shell environment variable that sets an interactive shell's idle timeout, in seconds: after TMOUT seconds with no input, the shell exits. TMOUT=<n> sets the timeout to n seconds (a value of 0 disables it); marking the variable readonly prevents a user from overriding it during the session, and exporting it applies it to the user's shell environment.

チェック方法

監査方法: シェルコマンド

shell

alt0() { o=$(bash -c '#!/usr/bin/env bash
{
   l_max=900
   a_files=()
   while IFS= read -r l_file; do a_files+=("$l_file"); done < <(grep -Pls -- '"'"'^([^#\n\r]+)?\bTMOUT\b'"'"' \
      /etc/*bashrc /etc/profile /etc/profile.d/*.sh /etc/profile.d/sh.local \
      /usr/etc/profile.d/*.sh /usr/etc/profile.d/sh.local 2>/dev/null)
   l_set=0
   for l_file in "${a_files[@]}"; do
      l_val="$(grep -Po -- '"'"'^([^#\n\r]+)?\bTMOUT=\d+\b'"'"' "$l_file" | awk -F= '"'"'{v=$2} END{if (NR>0) print v}'"'"')"
      [ -z "$l_val" ] && continue
      l_set=1
      l_ro="$(grep -P -- '"'"'^\h*(typeset\h\- xr\hTMOUT=\d+|([^#\n\r]+)?\breadonly\h+TMOUT\b)'"'"' "$l_file")"
      l_exp="$(grep -P -- '"'"'^\h*(typeset\h\- xr\hTMOUT=\d+|([^#\n\r]+)?\bexport\b([^#\n\r]+\b)?TMOUT\b)'"'"' "$l_file")"
      [ "$l_val" -gt 0 ] && [ "$l_val" -le "$l_max" ] || echo "$l_file: TMOUT=$l_val is out of range (must be >0 and <=$l_max)"
      [ -n "$l_ro" ]  || echo "$l_file: TMOUT is not marked readonly"
      [ -n "$l_exp" ] || echo "$l_file: TMOUT is not exported"
   done
   [ "$l_set" -eq 0 ] && echo "TMOUT is not set in any shell initialization file"
}' 2>&1); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

Configure TMOUT in a single file. Because best practice marks TMOUT readonly, a second assignment from a later-sourced file produces a "TMOUT: readonly variable" error at every login, so it must be set exactly once. 1. Run the following command to locate any existing TMOUT assignments in the shell initialization files: # grep -PHrs -- '\bTMOUT\b' /etc/profile /etc/profile.d/ /etc/bashrc /etc/*bashrc 2. In each file returned in step one, remove or comment out the TMOUT lines so TMOUT is no longer set in more than one location. 3. Create a single drop-in file in /etc/profile.d/ that sets, marks readonly, and exports TMOUT in one statement, using a value greater than 0 and no greater than 900 s…

プロパティ

オペレーティングシステム: almalinux-9
タグ: cis-convertedlinux
参照: CIS AlmaLinux OS 9 Benchmark v3.0.0 - 5.4.3.2

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target linux