V-285663

Discussion

Terminating idle user sessions reduces the risk of unauthorized access to information and system resources when a user leaves a session unattended. Automatic session termination helps prevent unauthorized individuals from assuming the identity of a previously authenticated user and gaining access to privileged functions or sensitive information. Harvester Government nodes provide administrative access through shell sessions. Configuring an inactivity timeout ensures unattended shell sessions are automatically terminated after a defined period of inactivity, reducing the opportunity for unauthorized access to the operating system and platform management functions.

Check Content

Verify Harvester Government automatically terminates inactive shell sessions.

1. Access Harvester Government using a privileged account and verify the auto-logout configuration file exists and is protected:

stat -c "%n %a %U %G" /etc/profile.d/autologout.sh

2. Verify the output returns:

/etc/profile.d/autologout.sh 755 root root

If the file does not exist, is not owned by root, or permissions differ from 755, this is a finding.

3. Verify the inactivity timeout configuration:

grep -E "^(TMOUT=900|readonly TMOUT)" /etc/profile.d/autologout.sh

4. Verify the output contains:

TMOUT=900
readonly TMOUT

If TMOUT is not configured to 900 seconds, TMOUT is not configured as read only, or the configuration is missing, this is a finding.