Securing Sessions with Client Timeout Enforcement

The client_idle_timeout in Teleport is a configurable setting that helps improve security by terminating inactive sessions after a specified period. It can be applied globally or per role, allowing for flexibility based on your organization's security policies. The client_idle_timeout configuration ensures that SSH sessions, desktop sessions, kubectl exec or database connections that remain inactive for a certain period of time are automatically terminated. This helps to mitigate risks associated with unattended sessions, such as unauthorized access.

Use cases

• Security compliance: Many organizations require idle timeout enforcement as part of their security policies, ensuring that inactive sessions are not left open.
• Risk mitigation: If users forget to disconnect from a session, an idle timeout ensures that they are logged out automatically after a set period of inactivity, reducing the risk of unauthorized access.

How it works

Teleport monitors user activity, such as key presses or mouse movement in desktop sessions, or network traffic from ssh or database connections. If there is no detected activity for the duration defined by client_idle_timeout, the session is terminated, forcing the user to reconnect.

Configuration

The client_idle_timeout can be configured globally or per role, giving administrators flexibility in how they apply client idle timeout rules.

Global configuration (applies to all users)

You can set the client_idle_timeout globally in the Teleport cluster configuration (teleport.yaml) under the auth_service section:

auth_service:
  client_idle_timeout: 15m

This example configures a global client idle timeout of 15 minutes. After 15 minutes of client inactivity, the session will be terminated.

If you are a cloud customer, you will need to modify these settings using dynamic configuration.

Log in and use the tctl admin tool:

tsh login --proxy=myinstance.teleport.sh
tctl status

Obtain your existing cluster_auth_preference resource:

tctl get cap > cap.yaml

Include client_idle_timeout in cap.yaml:

kind: cluster_auth_preference
metadata:
  name: cluster-auth-preference
spec:
  options:
    client_idle_timeout: 30m # Set your desired timeout value

Create the cluster_auth_preference resource via tctl:

tctl create -f cap.yaml

You should then see the following output:

cluster auth preference has been created

Per-role configuration (applies to specific users or groups)

You can also specify the timeout on a per-role basis, allowing different users or groups to have different timeout settings. For example, you might want a shorter timeout for higher-privileged roles.

kind: role
version: v3
metadata:
  name: admin-role
spec:
  options:
    client_idle_timeout: 10m

Default behavior

If the client_idle_timeout is not set, sessions will not automatically close due to inactivity unless other timeout policies (like disconnect_expired_cert) are applied.