Set Interactive Session Timeout
Defines a shell TMOUT value in /etc/profile, /etc/profile.d/ or /etc/bashrc so idle interactive shells are automatically logged out.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
Automatically terminating an idle session reduces the window in which an unattended console or SSH session left logged in can be hijacked by unauthorized personnel. Without TMOUT, a forgotten root shell on a screen-locked-but-not-logged-out terminal is a standing risk.
What Pavois checks
Pavois greps the shell init files (/etc/profile, /etc/profile.d/*, /etc/bashrc) for an uncommented TMOUT= assignment. Because TMOUT is a shell builtin set at login through these scripts (there is no service to query), the effective source of truth is the init files themselves, Pavois checks the very files the shell sources, including drop-ins under /etc/profile.d/.
describe command('grep -qrE \'^[^#]*TMOUT=[0-9]\' /etc/profile /etc/profile.d/ /etc/bashrc 2>/dev/null && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -rE '^[^#]*TMOUT=' /etc/profile /etc/profile.d/ /etc/bashrc. Expect at least one match such as readonly TMOUT=600. In a fresh login shell, echo $TMOUT should print the configured number of seconds.
Inspect & investigate
Session ends triggered by TMOUT close the SSH/console session, logged in /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL). Verify the variable directly with echo $TMOUT in an interactive shell.
Remediation
No automated harden plan ships for this rule; apply it manually. Add a file such as /etc/profile.d/tmout.sh containing TMOUT=600; readonly TMOUT; export TMOUT (10 minutes). Using readonly prevents users from unsetting it. Beware that only /bin/sh/bash honor TMOUT; other shells (zsh, fish) need their own equivalent.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| content | TMOUT=900 readonly TMOUT export TMOUT |
|---|---|
| group | root |
| mode | 0644 |
| owner | root |
| path | /etc/profile.d/99-pavois-tmout.sh |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Setting TMOUT too low frustrates legitimate work, long-running interactive commands at the prompt, a paused editor, or a watched log can disconnect mid-use, and a readonly value cannot be overridden per session. Choose a value (commonly 600:900 s) that balances security and usability, and remember it applies to all interactive shells including administrators'. It does not affect non-interactive jobs, cron, or established background processes, so there is no service-outage risk.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| ANSSI BP-028 | R32 | direct | 2.0 | high |
| CIS | 5.4.3.2, 8.6.1 | direct | per OS, see the benchmark table | high |
| NIST | 3.1.11, AC-12, AC-2(5), CM-6(a), SC-10 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
| PCI DSS | 8.6.1 | supporting | 4.0.1 | medium |
| DISA STIG | UBTU-22-412030, UBTU-24-200060 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.