Close idle shell sessions automatically

Description

When the read-only TMOUT variable is set, bash and dash close an interactive shell that waited that many seconds for input. Setting it in /etc/profile.d/ applies it to the login shells of every user, and readonly stops users from removing it.

Rationale

Open terminals left on a console, in a jump host session or in a forgotten SSH connection are an easy way to reuse someone's access, sometimes with root privileges.

Impact

Idle interactive shells exit after {{ tmout }} seconds. Long-running commands are not affected, but a shell waiting at the prompt is closed: use tmux or screen for sessions that must stay open.

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

Run su -s /bin/sh -l nobody -c 'echo $TMOUT'. It must print a value between 1 and {{ tmout }}.

Automated: every check must pass. Scanners report each check by its id.

login-shell

TMOUT in a login shell.

script: |
  t=$(su -s /bin/sh -l nobody -c 'printf %s "${TMOUT:-}"' 2>/dev/null) || exit 3
  echo "TMOUT=${t:-unset}"
  [ -n "$t" ] && [ "$t" -ge 1 ] && [ "$t" -le "$CB_TMOUT" ]

Remediation

Create /etc/profile.d/60-cirsec-tmout.sh:

TMOUT={{ tmout }}
readonly TMOUT
export TMOUT

Rollback

Delete /etc/profile.d/60-cirsec-tmout.sh.

profile

f=/etc/profile.d/60-cirsec-tmout.sh
cb_backup "$f"
printf '%s\n' '# Written by CIRSEC Baselines CB-DEB-AUTH-020' "TMOUT=$CB_TMOUT" 'readonly TMOUT' 'export TMOUT' >"$f"
chmod 644 "$f"

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• bash(1), Debian manual pages (TMOUT) Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R32) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle