search

pyllyukko / harden.yml

Ansible playbook for Linux hardening
MIT License
75 stars 9 forks source link

Re-think how TMOUT is handled #23

Closed pyllyukko closed 2 years ago

pyllyukko commented 6 years ago

Installing tmout.sh into /etc/profile.d is necessarily not enough. E.g. if sudo is invoked without -i, it doesn't apply.

Examples from different guides:

NSA RHEL guide

2.3.5.5 Implement Inactivity Time-out for Login Shells

/etc/profile.d/tmout.sh:

TMOUT=900
readonly TMOUT
export TMOUT

system-hardening-10.2.txt

/etc/profile:

# Logout if a root terminal is not being used
if [ `id -u` = "0" ]; then
    export TMOUT=1200
fi

CIS CentOS Linux 7 Benchmark v3.0.0

5.4.4 Ensure default user shell timeout is configured (Automated)

TMOUT=900
readonly TMOUT
export TMOUT

CIS Debian Linux 10 Benchmark v1.0.0

pyllyukko commented 3 years ago

We could add TMOUT to sudo_env.

pyllyukko commented 3 years ago

Value should be no more than 15 minutes.

pyllyukko commented 3 years ago

99a5e25f4a6d0e04574d45cda908c0ccc9f9404c

pyllyukko commented 3 years ago

Related issue: #72

pyllyukko commented 2 years ago

The timeout value should be a variable and used consistently across various configs.