# Ensure default user shell timeout is configured

Necessity: Configuring a default user shell timeout is a critical security measure to prevent unauthorized access through unattended, logged-in terminals. If a user walks away from a workstation without logging out, an attacker with physical access could execute commands with that user's privileges. Automatically logging out idle shell sessions significantly reduces this risk by closing the window of opportunity for such attacks.

Auditing and Remediation: The audit script inspects system-wide shell configuration files (e.g., /etc/profile, /etc/profile.d/*) to determine the currently configured value for the 'TMOUT' environment variable, which controls automatic logout. The remediation script establishes a secure timeout by creating a new configuration file in '/etc/profile.d/' that sets and exports the 'TMOUT' variable to the specified number of seconds for all new interactive shell sessions.

Recommended State Rationale:
- Basic ([900, 900]): A 15-minute timeout is a common baseline recommended by standards like the CIS Benchmarks. It provides a reasonable balance between security and user convenience, preventing sessions from remaining idle for extended periods.
- Moderate ([600, 600]): A 10-minute timeout enhances security by shortening the exposure window for an unattended session. This is suitable for environments handling more sensitive data where the risk of unauthorized physical access is higher.
- Strict (['lower bound', 300]): A timeout of 5 minutes (300 seconds) or less offers the highest level of protection. This is recommended for critical systems or in high-traffic, physically insecure areas, as it drastically minimizes the time an attacker has to exploit an abandoned session.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[900, 300]` |
| **Moderate** | `[600, 300]` |
| **Strict** | `[300, 300]` |
| **Type** | `RANGE` |

## Audit Script Working

bash script that checks for the 'TMOUT' variable setting in '/etc/profile' and files within '/etc/profile.d/'. The script should parse the configuration to find the timeout value in seconds. It must return only the numeric value. If the value is not set or is set to 0 or a non-numeric value, the script should return '0'.

## Remediation Script Working

bash script that accepts a single positional integer argument representing the timeout value in seconds. The script must create or modify a file, such as '/etc/profile.d/autologout.sh', to set and export the 'TMOUT' variable for all new user sessions. The script must return 'true' on successful configuration and 'false' on failure.

