How to enable auto logout in fish shell?

Question

A quick google search says I could enable auto logout (for text consoles) by setting a TMOUT parameter. However, I discovered later that this would only work with the bash shell.

Is there a way I could set a timer for auto logout if my default shell was fish?

What is the purpose? Security, of course. I want it to lock when it's idle for 1 minute.

Answer 1

While Fish itself doesn't include support for TMOUT directly, there are a few alternatives that might work for you. Given the fact that my two approaches are so radically different, I'm going to include them in two separate answers.

First (and not my preferred approach, but it's closest to the Bash functionality), depending on your Fish version:

Short answer:

Create a new file ~/.config/fish/conf.d/fish_tmout.fish:

function start_logout_timer --on-event fish_prompt
    # Allows $last_pid to work in a function
    status job-control full
    if set --query __fish_tmout_pid
        # Stop previous timer
        kill -- -$__fish_tmout_pid
    end
    # Start new timer
    FISH_PID=%self sh -c "sleep 60; kill -HUP $FISH_PID" &
    # Allows logout without warning of background jobs
    disown
    set -gx __fish_tmout_pid $last_pid
end

function stop_logout_timer --on-event fish_preexec
    if set --query __fish_tmout_pid
        kill -- -$__fish_tmout_pid
    end
    set --erase __fish_tmout_pid
end

Restart your shell and you should find that you are automatically logged out after 1 minute of no activity in the shell.

Compatibility: At least Fish 3.2.2 and later. Known to not work on 3.0.2 and earlier.

Minor caveat: You will always have an extra "defunct sh" hanging out when you do a ps.

Note: This does handle multiple shell instances running, since each shell is tracking its own PID and timer in a global (not universal) variable.

Explanation:

You can attempt to replicate that Bash functionality through other Fish features. But since (from your comment on Stack Overflow), you want this in order to secure the session from other people around you in case you forget to log out, you should be aware of the limitations of both this and the TMOUT option available in other shells. Namely, if you walk away while using any "full-screen" app that has control of the terminal (e.g. less, vim, or plenty of others), then it's not going to work. TMOUT is only handled when you leave Bash idle at the prompt.

Likewise, this approach has the same limitation. With that in mind ...

The Bash manual has this to say about TMOUT:

In an interactive shell, the value is interpreted as the number of seconds to wait for a line of input after issuing the primary prompt. Bash terminates after waiting for that number of seconds if a complete line of input does not arrive.

In Fish parlance, that would be either:

• The time period between the display of two consecutive prompts
• The time period between the display of a prompt and the user entering an interactive command

Which can be handled by Fish function hooks for:

• fish_prompt
• fish_preexec

So the script above:

• Starts an auto-logout timer (via sleep) when the prompt is displayed (fish_prompt)
• Stops that timer (by killing the subprocess owning the timer and logout) when either the next prompt is displayed (fish_prompt) or a command is entered (fish_preexec).
• Logs out of the shell (via SIGHUP) when the timer expires without being killed

Answer 2

Another option for "securing the shell when inactive" is to use tmux, possibly in conjunction with vlock, assuming they are available on the server in question or you have permission to install them.

Assuming those are installed and in place, edit your ~/.tmux.conf and add the following:

set -g lock-after-time 60
set -g lock-command vlock

or ...

set -g lock-after-time 60
set -g lock-command "tmux kill-session"

That will lock or kill the entire Tmux session (all panes) after 60 seconds of inactivity. While I don't see this in the Tmux doc, inactivity in this case seems to be defined by "lack of keypress". In my testing, on-screen output from commands (such as a tail -f) do not seem to stop the inactivity-timer.

This is more secure than the TMOUT alternative, since it also works when you are running an interactive command like vi or less.

Note that in order to make this truly secure, tmux needs to be running as the top-level PID in your ssh session or terminal. There are a couple of ways to do this:

• If you are connecting to the server via an ssh client (and it sounded like this might be the case), then just specify tmux as the RemoteCommand. The way to do this might vary depending on your client (e.g. Putty), but for a standard command-line client, you would execute something like:

  > ssh user@server tmux #or
  > ssh -o "RemoteCommand=tmux" user@server
  

• Or add the RemoteCommand=tmux to your ~/.ssh/config for that server

• Or, if you want to start Tmux manually after connection to the server, or potentially in your ~/.bash_profile (although be careful with this). Then use exec tmux so that tmux replaces the parent shell. When exiting or disconnecting from tmux, you'll be logged out immediately (or returned to a higher-level process, only if there was one), rather than the shell that you started it from.