documentation_complete: true


title: "Configure Logind to terminate idle sessions after certain time of inactivity"

description: |-
    To configure <tt>logind</tt> service to terminate inactive user sessions
    after {{{ xccdf_value("var_logind_session_timeout") }}} seconds, edit the file
    <tt>/etc/systemd/logind.conf</tt>. Ensure that there is a section
    <pre>[Login]</pre> which contains the configuration
    <pre>StopIdleSessionSec={{{ xccdf_value("var_logind_session_timeout") }}}</pre>.

rationale: |-
    Terminating an idle session within a short time period reduces the window of
    opportunity for unauthorized personnel to take control of a management
    session enabled on the console or console port that has been let unattended.

severity: medium

platforms:
    - os_linux[rhel]>=8.7 and os_linux[rhel]!=9.0
    - os_linux[ol]>=8.7
    - os_linux[sles]>=15

identifiers:
    cce@rhel8: CCE-90784-0
    cce@rhel9: CCE-90785-7
    cce@rhel10: CCE-88334-8
    cce@sle15: CCE-92692-3
    cce@sle16: CCE-96699-4

references:
    cis-csc: 1,12,13,14,15,16,18,3,5,7,8
    cjis: 5.5.6
    cobit5: APO13.01,BAI03.01,BAI03.02,BAI03.03,DSS01.03,DSS03.05,DSS05.04,DSS05.05,DSS05.07,DSS05.10,DSS06.03,DSS06.10
    cui: 3.1.11
    isa-62443-2009: 4.3.3.2.2,4.3.3.5.1,4.3.3.5.2,4.3.3.6.1,4.3.3.6.2,4.3.3.6.3,4.3.3.6.4,4.3.3.6.5,4.3.3.6.6,4.3.3.6.7,4.3.3.6.8,4.3.3.6.9,4.3.3.7.2,4.3.3.7.3,4.3.3.7.4,4.3.4.3.3
    isa-62443-2013: 'SR 1.1,SR 1.10,SR 1.2,SR 1.3,SR 1.4,SR 1.5,SR 1.7,SR 1.8,SR 1.9,SR 2.1,SR 6.2'
    iso27001-2013: A.12.4.1,A.12.4.3,A.14.1.1,A.14.2.1,A.14.2.5,A.18.1.4,A.6.1.2,A.6.1.5,A.7.1.1,A.9.1.2,A.9.2.1,A.9.2.2,A.9.2.3,A.9.2.4,A.9.2.6,A.9.3.1,A.9.4.1,A.9.4.2,A.9.4.3,A.9.4.4,A.9.4.5
    nerc-cip: CIP-004-6 R2.2.3,CIP-007-3 R5.1,CIP-007-3 R5.2,CIP-007-3 R5.3.1,CIP-007-3 R5.3.2,CIP-007-3 R5.3.3
    nist: CM-6(a),AC-17(a),AC-2(5),AC-12,AC-17(a),SC-10,CM-6(a)
    nist-csf: DE.CM-1,DE.CM-3,PR.AC-1,PR.AC-4,PR.AC-6,PR.AC-7,PR.IP-2
    ospp: FMT_SMF_EXT.1.1
    pcidss: Req-8.1.8
    srg: SRG-OS-000163-GPOS-00072
    stigid@ol8: OL08-00-020035

ocil_clause: "the option is not configured"

ocil: |-
    Display the contents of the file <tt>/etc/systemd/logind.conf</tt>:
    <pre>cat /etc/systemd/logind.conf</pre>
    Ensure that there is a section <tt>[login]</tt> which contains the
    configuration <tt>StopIdleSessionSec={{{ xccdf_value("var_logind_session_timeout")
    }}}</tt>.
