← Back to Red Hat Enterprise Linux 9 Security Technical Implementation Guide

V-258077

CAT II (Medium)

RHEL 9 must terminate idle user sessions.

Rule ID

SV-258077r1155659_rule

STIG

Red Hat Enterprise Linux 9 Security Technical Implementation Guide

Version

V2R8

CCIs

CCI-001133

Discussion

Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended.

Check Content

Verify RHEL 9 logs out sessions that are idle for 10 minutes with the following command:

$ systemd-analyze cat-config systemd/logind.conf | grep StopIdleSessionSec

#StopIdleSessionSec=infinity
StopIdleSessionSec=600

If "StopIdleSessionSec" is not configured to "600" seconds, this is a finding.

Fix Text

Configure RHEL 9 to log out idle sessions.

Create the directory if necessary:

$ mkdir -p /etc/systemd/logind.conf.d/

Create a *.conf file in /etc/systemd/logind.conf.d/ with the following content:

[Login]
StopIdleSessionSec=600
KillUserProcesses=no

Restart systemd-logind:

$ systemctl restart systemd-logind