topic Re: Inactivity Logout in Operating System - HP-UX

Inactivity Logout

Fred K. Abell Jr._1 — Tue, 31 Aug 2010 13:48:11 GMT

Using CDE and running HP-UX 11.11 on J6750 workstation, I want to make accounts log totally off after a certain period of inactivity. Currently the terminal locks and requires other users to use the root password to unlock, which presents its’ own set of problems. Getting users to act responsibility is out of the question. Thanks in advance.

Fred

Re: Inactivity Logout

Dennis Handly — Tue, 31 Aug 2010 15:03:05 GMT

In a real shell, you can set TMOUT to log it out after that many idle seconds.

Re: Inactivity Logout

Steven E. Protter — Tue, 31 Aug 2010 17:46:54 GMT

Shalom Fred,

TMOUT will work for shell sessions that are idle.

Once an app is fired up, the app needs to take care of this function.

SEP

Re: Inactivity Logout

Hakki Aydin Ucar — Wed, 01 Sep 2010 07:24:46 GMT

As an example by default;

# echo $TMOUT
0
# export TMOUT=5
# echo $TMOUT
5
#
Shell will time out in 60 seconds.

Re: Inactivity Logout

rariasn — Wed, 01 Sep 2010 08:04:58 GMT

Hi Fred:

TMOUT:

You can configure the TMOUT variable to automatically lock inactive terminals.
If you use other systems often and if you copy the .profile file from one system to
another, then adding the TMOUT variable to the .profile is more convenient. If you
typically stay on one system, then either method of locking the terminal can be used.
To configure the TMOUT variable, edit the .profile file as shown in the following:
# vi ~/.profile
export TMOUT=600 # (lock after 600 seconds of inactivity)
You can change the 600 to another desired value.

CDE LOCK:
You can configure the CDE lock manager to lock your screen after a certain amount of
inactive time. To configure the CDE lock manager to lock the screen after 10 minutes
of inactive time, enter the following commands:

# cp /usr/dt/config/C/sys.resources /etc/dt/config/C/sys.resources
# vi /etc/dt/config/C/sys.resources
dtsession*lockTimeout: 10

You can also use the Style Manager task panel to adjust the CDE lock manager. To do
this, click on the screen icon.

rgs,

Re: Inactivity Logout

Matti_Kurkela — Wed, 01 Sep 2010 08:14:59 GMT

When you're using CDE, the inactivity logout is trickier to implement, because there isn't necessarily any terminals active. Also you'd want to logout the entire CDE session, not just the terminals.

If you send a "kill -HUP" to the user's dtsession process, that should kill the entire CDE session in a controlled fashion.

I don't have a workstation system available right now so I cannot check... but if the screen saver/locker causes a recognizable process to appear when it's active, it might be possible to use it as "inactivity indicator", so a relatively simple script or program should be able to detect the sessions that have been inactive for too long.

Pseudo-code:

if (there is a dtsession process running) {
identify the user running the session
if (the session has a screensaver running) {
find the start time of the screensaver process
screensaver.runtime = current_time - screensaver.starttime
if (screensaver.runtime > inactivity limit) {
kill -HUP
}
}
}

MK

Re: Inactivity Logout

Dennis Handly — Thu, 02 Sep 2010 05:22:19 GMT

>Hakki: export TMOUT=5
>Shell will time out in 60 seconds.

That's 5 seconds.

Re: Inactivity Logout

Hakki Aydin Ucar — Thu, 02 Sep 2010 05:39:47 GMT

>Dennis: >>Hakki: export TMOUT=5
>>Shell will time out in 60 seconds.

>That's 5 seconds.

Yes , it is weird, is there any other parameter to set minimum timeout like 60 seconds ??

$ uname -a
HP-UX igui01 B.11.11 U 9000/800 1889900691 unlimited-user license

$ export TMOUT=1
$
shell time out in 60 seconds
$ export TMOUT=61
$ echo $TMOUT
61
$
shell time out in 60 seconds

Re: Inactivity Logout

Dennis Handly — Thu, 02 Sep 2010 06:26:58 GMT

>Hakki: it is weird, is there any other parameter to set minimum timeout like 60 seconds?

Hmm, you're saying it doesn't work as documented?
I suppose we could use tusc to see how it works.

Re: Inactivity Logout

Jim Walls — Thu, 02 Sep 2010 07:08:50 GMT

I've run some experiments on an 11.23 server and it appears, to me, that the value of TMOUT works as fiollows:

export TMOUT=120

after an elapse of about two minute I get the...

Shell will time out in 60 seconds.

...prompt. A minute later the session disconnects.

If I interact before the 60 seconds expire, then I get another two minutes before being prompted again.

So, from my observation it seems to work, more or less, as expected.

The 60 second warning does not appear if I'm using bash but the session terminates all the same!

Re: Inactivity Logout

Hakki Aydin Ucar — Thu, 02 Sep 2010 07:30:50 GMT

>Jim: The 60 second warning does not appear if I'm using bash but the session terminates all the same!

So , 60 seconds is something hard coded OR default in somewhere as countdown to the termination ?

Re: Inactivity Logout

Jim Walls — Thu, 02 Sep 2010 08:04:45 GMT

I haven't done an accurate timing for bash... but what appeared to happen was that after between two and three minutes the session terminated without warning.

In the sh-posix case it appears to emit the warning 60 seconds after the $TMOUT period has elapsed and then terminate 60 seconds after the warning.

I'll do a better timing with bash to confirm.

Re: Inactivity Logout

Jim Walls — Thu, 02 Sep 2010 08:24:13 GMT

OK! Here is the session log for bash:

First: Call ssh and prime a call on date for when we return

[jimw@jimwpc3 ~]$ ssh pocuast2;date
Last login: Thu Sep 2 20:02:24 2010 from 10.81.105.17
Value of TERM has been set to "xterm".
WARNING: YOU ARE SUPERUSER !!
[root@pocuast2 /root ] exec bash
[root@pocuast2 root] date;export TMOUT=120
Thu Sep 2 21:05:57 NZST 2010
[root@pocuast2 root]
[root@pocuast2 root] timed out waiting for input: auto-logout
Connection to pocuast2 closed.
Thu Sep 2 21:08:00 NZST 2010
[jimw@jimwpc3 ~]$

As you can see, the total duration was about a little over TWO minutes.

Next I logged a sh-posix session:

[jimw@jimwpc3 ~]$ ssh pocuast2;date
Last login: Thu Sep 2 21:05:13 2010 from 10.81.105.17
Value of TERM has been set to "xterm".
WARNING: YOU ARE SUPERUSER !!
[root@pocuast2 /root ] date;export TMOUT=120
Thu Sep 2 21:17:24 NZST 2010
[root@pocuast2 /root ]
Shell will time out in 60 seconds.
sh: Timed out waiting for input.
Connection to pocuast2 closed.
Thu Sep 2 21:20:24 NZST 2010
[jimw@jimwpc3 ~]$

As you can see, POSIX shell users get a wrning and an extra 60 seconds ;O)

Re: Inactivity Logout

Dennis Handly — Fri, 03 Sep 2010 05:42:31 GMT

>Jim: Shell will time out in 60 seconds.
>...prompt. A minute later the session disconnects.

Yes.

>Hakki: 60 seconds is something hard coded

TGRACE is hard coded as 60.

>Jim: In the sh-posix case it appears to emit the warning 60 seconds after the $TMOUT period has elapsed and then terminate 60 seconds after the warning.

My experiments with real shells indicate you get TMOUT, then you get a 60 grace period. Then:
sh: Timed out waiting for input.

Re: Inactivity Logout

Hakki Aydin Ucar — Fri, 03 Sep 2010 06:47:13 GMT

>Dennis: TGRACE is hard coded as 60.

>Jim: >>

My experiments with real shells indicate you get TMOUT, then you get a 60 grace period. Then:
sh: Timed out waiting for input.

So , Timeout gracely manner is valid for POSIX and other shells like KSH;

# ksh
# echo $0
ksh
# export TMOUT=5
#
shell time out in 60 seconds
((AFTER 60 seconds, because I changed my shell from POSIX to ksh,otherwise it would be terminated))
ksh: timed out waiting for input