{"description": "To enable console screen locking in <tt>tmux</tt> terminal multiplexer\nafter a period of inactivity,\nthe <tt>lock-after-time</tt> option has to be set to a value greater than 0 and less than\nor equal to 900 in <tt>/etc/tmux.conf</tt>.", "rationale": "Locking the session after a period of inactivity limits the\npotential exposure if the session is left unattended.", "severity": "medium", "references": {"ospp": ["FMT_SMF_EXT.1", "FMT_MOF_EXT.1", "FTA_SSL.1"], "srg": ["SRG-OS-000029-GPOS-00010", "SRG-OS-000031-GPOS-00012"]}, "control_references": {}, "components": [], "identifiers": {}, "ocil_clause": "\"lock-after-time\" is not set to \"900\" or less in the global tmux configuration file to enforce session lock after inactivity", "ocil": "Verify Ubuntu 22.04 initiates a session lock after 15 minutes of inactivity.\n\nCheck the value of the system inactivity timeout with the following command:\n\n<pre>$ grep -i lock-after-time /etc/tmux.conf</pre>\n\n<pre>set -g lock-after-time 900</pre>\n\nThen, verify that the /etc/tmux.conf file can be read by other users than root:\n\n<pre>$ sudo ls -al /etc/tmux.conf</pre>", "oval_external_content": null, "fixtext": "Configure Ubuntu 22.04 to enforce session lock after a period of 15 minutes\nof inactivity by adding the following line to the \"/etc/tmux.conf\" global configuration file:\n\nset -g lock-after-time 900\n\nThen, ensure a correct mode of /etc/tmux.conf using this command:\n\n$ sudo chmod 0644 /etc/tmux.conf", "checktext": "", "vuldiscussion": "", "srg_requirement": "Ubuntu 22.04 must automatically lock command line user sessions after 15 minutes of inactivity.", "warnings": [], "conflicts": [], "requires": [], "policy_specific_content": {"stig": {"srg_requirement": "Ubuntu 22.04 must automatically lock command line user sessions after 15 minutes of inactivity.", "vuldiscussion": "A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not logout because of the temporary nature of the absence. Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity, tmux can be configured to identify when a user's session has idled and take action to initiate a session lock.", "checktext": "Verify Ubuntu 22.04 initiates a session lock after 15 minutes of inactivity.\n\nCheck the value of the system inactivity timeout with the following command:\n\n$ grep -i lock-after-time /etc/tmux.conf\n\nset -g lock-after-time 900\n\nIf \"lock-after-time\" is not set to \"900\" or less in the global tmux configuration file to enforce session lock after inactivity, this is a finding.", "fixtext": "Configure Ubuntu 22.04 to enforce session lock after a period of 15 minutes of inactivity by adding the following line to the \"/etc/tmux.conf\" global configuration file:\n\nset -g lock-after-time 900"}}, "platform": "package[tmux]", "platforms": ["package[tmux]"], "sce_metadata": {}, "inherited_platforms": ["system_with_kernel"], "cpe_platform_names": ["package_tmux"], "inherited_cpe_platform_names": ["system_with_kernel"], "bash_conditional": null, "fixes": {}, "title": "Configure tmux to lock session after inactivity", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/system/accounts/accounts-physical/screen_locking/console_screen_locking/configure_tmux_lock_after_time/rule.yml", "template": null}