Product SiteDocumentation Site

⁠4.4.4. Enabling Automatic Logouts

Especially when the user is logged in as root, an unattended login session may pose a significant security risk. To reduce this risk, you can configure the system to automatically log out idle users after a fixed period of time:
  1. Make sure the screen package is installed. You can do so by running the following command as root: 
    yum install screen
    For more information on how to install packages in Fedora, refer to Section 5.2.4, “Installing Packages”.
  2. As root, add the following line at the beginning of the /etc/profile file to make sure the processing of this file cannot be interrupted: 
    ​trap "" 1 2 3 15
  3. Add the following lines at the end of the /etc/profile file to start a screen session each time a user logs in to a virtual console or remotely: 
    ​SCREENEXEC="screen"
​if [ -w $(tty) ]; then
​  trap "exec $SCREENEXEC" 1 2 3 15
​  echo -n 'Starting session in 10 seconds'
​  sleep 10
​  exec $SCREENEXEC
​fi
    Note that each time a new session starts, a message will be displayed and the user will have to wait ten seconds. To adjust the time to wait before starting a session, change the value after the sleep command.
  4. Add the following lines to the /etc/screenrc configuration file to close the screen session after a given period of inactivity: 
    ​idle 120 quit
​autodetach off
    This will set the time limit to 120 seconds. To adjust this limit, change the value after the idle directive.
    Alternatively, you can configure the system to only lock the session by using the following lines instead: 
    ​idle 120 lockscreen
​autodetach off
    This way, a password will be required to unlock the session.
The changes take effect the next time a user logs in to the system.