Leaving an active, logged-in terminal unattended is one of the most severe security violations a Linux administrator can commit. If you use ssh to log into a production server, elevate your privileges using sudo su, and then walk away to get a cup of coffee, anyone walking past your desk has complete, unfettered root access to your entire infrastructure.
While graphical desktop environments (like GNOME or KDE) have built-in screensavers that lock the screen after 15 minutes, headless servers and raw SSH sessions rely entirely on the Bash shell, which will stay open infinitely by default. To secure a server environment, you must configure the shell itself to automatically terminate idle sessions.
You can enforce this globally using a built-in Bash environment variable called TMOUT.
How TMOUT Works
The TMOUT variable tells the Bash shell exactly how many seconds it should wait for keyboard input. If you set TMOUT=600, the shell will start a 10-minute timer. Every time you press a key, the timer resets. If you go 600 seconds without touching the keyboard, Bash will automatically execute an exit command, terminating the shell and closing the SSH connection immediately.
Step 1: Test TMOUT Locally
Before applying it globally, you can test it in your current, active session.
- Open your terminal or SSH into your server.
- Type the following command to set a 10-second timeout:
export TMOUT=10 - Press Enter.
Take your hands off the keyboard. Exactly ten seconds later, your terminal will print timed out waiting for input: auto-logout and instantly close the session.
Step 2: Enforce TMOUT Globally for All Users
To ensure this security policy applies to every single user who logs into the server (including the root user), you must define the variable in the global system profile configuration.
- Log back into your server.
- Open the global profile file using a text editor with root privileges (we will use nano):
sudo nano /etc/profile - Scroll all the way down to the very bottom of the file.
- Paste the following two lines (we will use 900 seconds, which equals 15 minutes of inactivity):
TMOUT=900 readonly TMOUT export TMOUT
Why Use “readonly”?
The readonly TMOUT line is a critical security measure. If you only export the variable, a clever user could log into the server, type export TMOUT=0, and completely disable the auto-logout timer for their session. By declaring the variable as readonly in the root /etc/profile, you lock the variable. If a user tries to change it, Bash will throw an error stating that the variable is read-only, making the 15-minute timeout an inescapable, mandatory security policy.
Step 3: Apply the Changes
- Save the file and exit the editor (in nano, press Ctrl+O, Enter, then Ctrl+X).
The new policy will automatically apply the next time any user establishes a new SSH connection or opens a new terminal window. To apply it immediately to your current session, you can run source /etc/profile.