cis-ubuntu2004-v300-5-4-3-2

name	cis-ubuntu2004-v300-5-4-3-2
description	Ensure default user shell timeout is configured
category	cis-iam
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","users","authentication"]
cis_id	5.4.3.2
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

5.4.3.2 Ensure default user shell timeout is configured (Automated)

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

TMOUT is an environmental setting that determines the timeout of a shell in seconds.

• TMOUT=n - Sets the shell timeout to n seconds. A setting of TMOUT=0 disables timeout.
• readonly TMOUT- Sets the TMOUT environmental variable as readonly, preventing unwanted modification during run-time.
• export TMOUT - exports the TMOUT variable

System Wide Shell Configuration Files:

• /etc/profile - used to set system wide environmental variables on users shells. The variables are sometimes the same ones that are in the .bash_profile, however this file is used to set an initial PATH or PS1 for all shell users of the system. is only executed for interactive login shells, or shells executed with the --login parameter.
• /etc/profile.d - /etc/profile will execute the scripts within /etc/profile.d/*.sh. It is recommended to place your configuration in a shell script within /etc/profile.d to set your own system wide environmental variables.
• /etc/bash.bashrc - System wide version of .bashrc. In Fedora derived distributions, /etc/bashrc also invokes /etc/profile.d/*.sh if non-login shell, but redirects output to /dev/null if non-interactive. Is only executed for interactive shells or if BASH_ENV is set to /etc/bash.bashrc.

Rationale

Setting a timeout value reduces the window of opportunity for unauthorized user access to another user's shell session that has been left unattended. It also ends the inactive session and releases the resources associated with that session.

Audit Procedure

Command Line

Run the following script to verify that TMOUT is configured to: include a timeout of no more than 900 seconds, to be readonly, to be exported, and is not being changed to a longer timeout.

#!/usr/bin/env bash

{
  a_output=(); a_output2=(); l_tmout_set="900"
  f_tmout_read_chk()
  {
    a_out=(); a_out2=()
    l_tmout_readonly="?\breadonly\h+TMOUT\b)' "
    l_tmout_export=
     [ -n  ]; 
      a_out+=()
    
      a_out2+=()
    
     [ -n  ]; 
      a_out+=()
    
      a_out2+=()
    
  }
   IFS=  -r l_file; 
    l_tmout_value=
    f_tmout_read_chk
     [ -n  ]; 
       [[  -le  &&  -gt  ]]; 
        a_output+=()
        [  -gt 0 ] && a_output+=()
        [  -gt 0 ] && a_output2+=()
      
       [[  -gt  ||  -le  ]]; 
        a_output2+=()
        [  -gt 0 ] && a_output2+=()
        [  -gt 0 ] && a_output2+=()
      
    
      [  -gt 0 ] && a_output2+=( )
      [  -gt 0 ] && a_output2+=( )
    
   < <(grep -Pls --  /etc/*bashrc /etc/profile /etc/profile.d/*.sh)
  [[  -le 0 &&  -le 0 ]] && a_output2+=()
   [ -z  ]; 
         
  
           
    [ -n  ] &&  -e  
    [  -gt 0 ] &&    
  
}