Force logout after a period of inactivity

[Raj Kairam]

I would like a way to force a user session to end as if logged out after a certain period of inactivity.

Thanks
Raj

[John Waller]

You could add TMOUT= to your .kshrc file. This will logout the user if they are idle within the shell, but not sure how to do it within the application without having a script run every minute.

[Kent Ostby]

export TMOUT=60 in .profile will logout a user after 60 seconds.

Best regards,

Oz

[Bill Hassell]

Only the user's shell can perform this task. You can set a timeout for inactivity at the shell prompt. However, if the user decides to run vi and walk away, the session will stay logged in forever. The value to set is TMOUT for POSIX shell, ksh (and other POSIX compliant shells like bash), or autologout for csh. Set the value based on the shell your users are running. For POSIX shells, /etc/profile will set all logins, or individual .profile (or .kshrc if your users have configured ksh to use that file, etc). TMOUT uses seconds so for a 1 hour inactivity timeout, use:

export TMOUT=3600

In csh, the autologout value is in minutes.

[Ranjith_5]

Hi Raj,

Set the TMOUT value for the system. You can either add it in /etc/profile OR $HOME/.profile. If you add this in /etc/profile the time out value will be same for all users where as in $HOME/.profile , you can set different values for different users. The line to be added is,

export TMOUT=300

This will allow a 300 sec ( 5 mins) in activity and then the session will be disconnected.

Regards,
Syam

[Ivan Ferreira]

The w command will give you the real idle time. I used this information in a script to kill the user process.

As methioned above, if the user leaves a vi open (or something like that), they aren't doing anything, but the TMOUT variable won't disconnect the user.

[Andy Torres]

There are some options germane to this discussion in the /opt/ssh/etc/ssh_config and /opt/ssh/etc/sshd_config files. Not sure which would take precedence, but thought I'd mention it. Worth a look, maybe.

[HGN]

Hi

We have set the TMOUT value in the /etc/profile and after the value the session will be termianted with a message.

If you think the comments/help provided by others have helped you assign points and close this thread.

Rgds

HGN

[Rick Garland]

As stated, the TMOUT variable in the profile will do what you are asking. If the user is in vi, or some application (e.g., oracle) then this variable becomes meaningless.

[Raj Kairam]

Thanks to all that replied.
I entered the following in my .cshrc
setenv TMOUT 120

After logging in, verified that the variable is set.
However, I did not see any message to the effect that my session was timed out or any thing like that in the session window even after a few minutes.

Thought some one can explian what I am doing wrong.
Thanks
Raj

[Dwyane Everts_1]

Raj,

From Bill's posting above:

"The value to set is TMOUT for POSIX shell, ksh (and other POSIX compliant shells like bash), or autologout for csh."

You need to apply "autologout" for csh.

Hope this helps...
Dwyane

[Bill Hassell]

When you type the command setenv, you are not using a POSIX shell, you are using csh (not very common) so you use the command:

setenv autologout 2

and now csh will exit after two minutes of idle time.

[Raj Kairam]

I am using csh and access the system (HP-UX 11) via Hummingbird Exceed installed on my Windows box and also via ssh.
Added the variable with 'setenv autologout 2' to my .cshrc ( assuming 2 minutes ).
After I log in and do 'echo $autologout' it shows 600. Even after I change my value to 60 from 2, it still shows 600.
Is there some other place where this 600 is preset that overrides what ever is entered in my starting .cshrc file?
I am still unable to force the session after a brief period of inactivity.
Please advise.

[Bill Hassell]

This is a very common problem with Xwindows. You are not logging in normally and therefore .c shrc is not even being run. When you use Xwindows on a PC, the text window you see is not a program on your PC but is a program running on the HP-UX computer (xterm, dtterm, or hpterm) and the default for Xwindows is to bypass all login profiles (/etc/csh.login and .cshrc for the csh shell). You can verify this by putting something like: echo "starting .cshrc" into your .cshrc and when you login, nothing is displayed.

To fix the problem, use this command after you login:

echo "*loginShell: true" >> $HOME/.Xdefaults

then start a new terminal window. You'll now see all the profile messages (like the copyright) as well as the "starting .cshrc" message. And your autologout variable will now be set and effective.

[Raj Kairam]

Thanks for the suggestion about putting loginShell in to $HOME/.Xdefaults

I did that and now I see the copyright stuff in the new text window ( opened by Exceed ).

However, I get 600 for $autologout even though I put 'setenv autologout 2' in my .cshrc.

Please advise.
Thanks
Raj

[Bill Hassell]

Start by listing possible login profiles for csh:

ls -la $HOME/.cshrc $HOME/.login

.cshrc should have read and execute permissions and owned by your login ID. .login is run after .cshrc, but it sounds like they are not getting run. Verify that by first putting an echo in each file, then login again. To see what happens when your shell actually runs .cshrc, use the source command:

source .cshrc

then display the autologout variable (which will likely be set). csh is quite non-standard as a shell in Unix (except for some programmers), so if you're not tied to a specific shell, you might switch to a more mainstream shell like /usr/bin/sh (HP's POSIX shell) or /usr/bin/ksh. You can change shells at any time with the chsh command:

chsh your_loginID /usr/bin/sh

For sh (which is not Bourne) and ksh, profiles are: /etc/profile and then .profile.

[Raj Kairam]

Thanks again.
I am forced to use the c shell and the .cshrc was given to us by the developer. There is no .login in $HOME.
The echo statements in the .cshrc show up fine after logging in. However, the variable always comes out as 600 regardless of what I put in the .cshrc files for my login.

I am totally at a loss.
Please advise.

Thanks
Raj

[Bill Hassell]

Ah, .cshrc may be the key. grep for autologout in .cshrc and also /etc/csh.login to see if the developers are setting it for you. Also, put an echo at the bottom of .cshrc to see if you're making it through the entire script. There may be an exit prior to your autologout statement.

[Raj Kairam]

I did put a dummy echo at the very end of the .cshrc file. It correctly shows up upon a login.

That rules out the possibility of an exit before the autologout setting is done.

There is no /etc/csh.login file at all in the system. The developer worked only on the .cshrc file.

What I am puzzled about is where the value 600 for the variable autologout coming from even though it is explicitly set in the .cshrc file.
Thanks
Raj

[Bill Hassell]

Look for "source" statements in the .cshrc file. Often, login profiles will set common variables by sourcing another script like /etc/oracle.profile or something similar. You can trace .cshrc with:

csh -x .cshrc

and this might help. The key is to look for special programs or scripts inside .cshrc that may be setting autologout.

[Raj Kairam]

Mr. Hassel,
Thanks for all your replies. You have been a great help.
I resolved my problem ( always seeing a value of 600 for autologout regardless of what I put in my .cshrc file ) by doing the following.
Replaced the 'setenv autologout 2' with 'set autologout=2' and now I don't see the 600 and see 2 as was intended.
I did not know I could use 'set' while in c shell.
I just have another question. After a login ( which now automatically logs me out after 2 minutes if I did not do anything in that text window ) I start an application which opens up another xterm where the application user interface comes up. It is this application that I would like to see closed if no activity is performed in that application.
My setting 2 minutes in the .cshrc seems to have no effect and the application's screen stays on.
Any thoughts on this ?. I'll appreciate if you could offer any suggestions.

Thanks
Raj

[Bill Hassell]

This is a common request but very difficult to implement. A user that starts vi may be very busy using the program or may have gone home--the shell doesn't know about this condition. The command: who -u may be of help for these terminal programs as it reports on termninal activity (hrs:mins since the last terminal inpuut.

An application, especially Xwindows programs that are not terminals (a graphics design program for instance) are very difficult because moving or clicking the mouse means nothing to HP-UX. That means that a command like who -u will report no activity on the tty (terminal) for that program even though it is quite busy computing or following mouse clicks. A user that starts vi may be very busy using the program or may have gone home--the shell doesn't know about this condition.

Some sysadmins will watch for increasing values in accumulated CPU time for these programs and kill the program if no additional CPU time is used. But this usually makes the users quite upset so most sysadmins ignore these programs. Note that an idle program consumes no resources. It will be swapped out automatically more RAM space is needed. ABout the only reasonto get rid of idle applications is for special licensing limitations.