If you manage a fleet of Linux servers for a team of developers, you will inevitably encounter a massive security and resource problem: Idle SSH connections.
Developers will frequently SSH into a production database server on Friday afternoon, run a few queries, and then simply close their laptop lid or go home for the weekend without typing exit. The SSH connection remains completely active and authenticated. If someone steals their laptop, or if they are working on an insecure public Wi-Fi network, that hanging, open root connection is a massive attack vector. Furthermore, idle connections consume server memory and file descriptors.
To enforce strict security compliance (like SOC2 or HIPAA), you must configure the Linux server to act ruthlessly. You can configure the Bash shell to constantly monitor every user’s keyboard. If a user does not type a single keystroke for a specified amount of time, the server will automatically terminate their session and forcefully kick them out.
Step 1: Open the Global Profile Script
To ensure this security rule applies to every single user on the machine (including the root administrator), you must inject the configuration into the global shell profile.
- Log into your server via SSH.
- Elevate to root and open the global profile in a text editor:
sudo nano /etc/profile
Step 2: Inject the TMOUT Variable
The Bash shell has a built-in, native environmental variable called TMOUT. It dictates exactly how many seconds the shell will wait for input before it commits suicide.
- Use the arrow keys to scroll to the very bottom of the file.
- Paste the following three lines of code:
TMOUT=600 readonly TMOUT export TMOUT
Understanding the Code
TMOUT=600: This sets the timeout limit to exactly 600 seconds (10 minutes). You can change this to 900 for 15 minutes, or 3600 for an hour.readonly TMOUT: This is the most critical line. If you do not make the variable “read-only,” a clever developer could simply log into the server, typeTMOUT=0, and completely bypass your security rule. Thereadonlycommand permanently locks the variable, making it impossible for anyone to override it.export TMOUT: This ensures the variable is pushed out to every active sub-shell and process.
Step 3: Save and Apply
- Press Ctrl+O then Enter to save the file.
- Press Ctrl+X to exit nano.
The change will not affect any users currently logged into the system. It will apply to all new SSH connections moving forward.
The Result
The next time a developer SSHs into the machine, the timer begins immediately. If they stare at the blinking cursor for exactly 10 minutes without typing a single character, the server will suddenly print timed out waiting for input: auto-logout, immediately sever the TCP connection, and drop them back to their local machine, ensuring your production infrastructure is never left dangerously exposed.