OL 8 must terminate idle user sessions.

Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended.

Note: For cloud hosted systems where "ClientAliveInterval" (V-248553) is configured, this setting is not applicable.

Verify OL 8 logs out sessions that are idle for 10 minutes with the following command:

$ systemd-analyze cat-config systemd/logind.conf | grep StopIdleSessionSec

#StopIdleSessionSec=infinity StopIdleSessionSec=600

If "StopIdleSessionSec" is not configured to "600" seconds, this is a finding.

Configure OL 8 to log out idle sessions.

Create the directory if necessary:

$ mkdir -p /etc/systemd/logind.conf.d/

Create a *.conf file in /etc/systemd/logind.conf.d/ with the following content:

[Login] StopIdleSessionSec=600 KillUserProcesses=no

Restart systemd-logind:

$ systemctl restart systemd-logind