3.3.4. Enabling Automatic Logouts

When the user is logged in as root, an unattended login session may pose a significant security risk. To reduce this risk, you can configure the system to automatically log out idle users after a fixed period of time:

Make sure the screen package is installed. You can do so by running the following command as root:
```
yum install screen
```
For more information on how to install packages in Red Hat Enterprise Linux, refer to Section 5.2.4, “Installing Packages”.
As root, add the following line at the beginning of the /etc/profile file to make sure the processing of this file cannot be interrupted:
```
trap "" 1 2 3 15
```
Add the following lines at the end of the /etc/profile file to start a screen session each time a user logs in to a virtual console or remotely:
```
SCREENEXEC="screen"
if [ -w $(tty) ]; then
  trap "exec $SCREENEXEC" 1 2 3 15
  echo -n 'Starting session in 10 seconds'
  sleep 10
  exec $SCREENEXEC
fi
```
Note that each time a new session starts, a message will be displayed and the user will have to wait ten seconds. To adjust the time to wait before starting a session, change the value after the sleep command.
Add the following lines to the /etc/screenrc configuration file to close the screen session after a given period of inactivity:
```
idle 120 quit
autodetach off
```
This will set the time limit to 120 seconds. To adjust this limit, change the value after the idle directive.
Alternatively, you can configure the system to only lock the session by using the following lines instead:
```
idle 120 lockscreen
autodetach off
```
This way, a password will be required to unlock the session.

The changes take effect the next time a user logs in to the system.