Vulnerability Discussion

Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended.

Check

Note: For cloud-hosted systems where "ClientAliveInterval" (V-257996) is configured, this setting is not applicable.

Verify RHEL 9 logs out sessions that are idle for 10 minutes with the following command:

$ systemd-analyze cat-config systemd/logind.conf | grep StopIdleSessionSec
#StopIdleSessionSec=infinity
StopIdleSessionSec=600

If "StopIdleSessionSec" is not configured to "600" seconds, this is a finding.

Fix

Configure RHEL 9 to log out idle sessions.

Create the directory if necessary:

$ mkdir -p /etc/systemd/logind.conf.d/

Create a *.conf file in /etc/systemd/logind.conf.d/ with the following content:

[Login]
StopIdleSessionSec=600
KillUserProcesses=no

Restart systemd-logind:

$ systemctl restart systemd-logind