# Ensure default user shell timeout is configured

The 'TMOUT' environment variable controls the automatic logout of a shell session after a specified period of inactivity. Necessity: Setting a shell timeout is a critical security measure to mitigate the risk of unauthorized access through unattended or hijacked user sessions. If a user leaves a terminal logged in and unattended, an unauthorized individual could execute commands with that user's privileges. This control automatically terminates idle sessions, reducing the window of opportunity for such attacks. Auditing and Remediation: The audit script verifies the current system-wide timeout setting by reading shell profile configurations. The remediation script enforces a desired timeout value by creating a global configuration file that sets the 'TMOUT' variable for all new user sessions. Recommended State Rationale: Basic: '[900, 900]' sets a 15-minute timeout, a widely accepted baseline (e.g., CIS Level 1) that balances security with user convenience. Moderate: '[301, 600]' tightens the timeout to between 5 and 10 minutes, enhancing security for environments requiring stricter controls without being overly disruptive. Strict: '[1, 300]' enforces a timeout of 5 minutes or less, providing the highest level of protection for sensitive systems where the risk of unattended sessions is high, ensuring idle terminals are secured very quickly.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[900, 300]` |
| **Moderate** | `[600, 300]` |
| **Strict** | `[300, 300]` |
| **Type** | `RANGE` |

## Audit Script Working

Bash script that inspects the system-wide shell configuration files, primarily `/etc/profile` and all scripts within the `/etc/profile.d/` directory, to find the configured value for the `TMOUT` environment variable. The script must parse and return only the numeric value of the timeout in seconds (e.g., '900'). If `TMOUT` is not set or is set to 0, the script should return '0'. The output must be clean, containing only the number with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single, positional command-line argument representing the desired shell timeout in seconds. The script must create or update a configuration file, such as `/etc/profile.d/cis_shell_timeout.sh`, to set and export the `TMOUT` variable system-wide (e.g., `export TMOUT=$1`). The script must ensure the file has appropriate permissions (readable by all, writable only by root). On successful application of the setting, the script must return the string 'true'; on failure, it must return 'false'.

