Return to Revisions

Setting idle-timeout for root directly from the CLI is not possible, unfortunately.

I wrote an event script that does what you need.

Basically, every 5 minutes it checks:

• If root is logged in via console (verified by a "-" in the FROM section of "show system users")
• If root is logged in, has it been idle for 15 minutes or more (checked in seconds, so 900 seconds).
• If all of those requirements are met, issue "request system logout terminal $TERM" (uses whatever terminal is present in the information the script pulled).

Non-XML version of what is pulled:

jhead@VPN-EP1> show system users
 4:02PM  up 2:56, 2 users, load averages: 0.07, 0.02, 0.00
USER     TTY      FROM                              LOGIN@  IDLE WHAT
root     v0       -                                3:55PM      6 cli
jhead    p0       172.16.67.1                      1:09PM      - -cli (cli)

You can see a closer representation of what information the script parses by issuing:

show system users | display xml

The Script Itself: (filename: terminate-idle-root.slax)

/*
 * Author        : Jordan Head
 * Company       : Juniper Networks
 * Version       : 1.0
 * Last Modified : December 13, 2015
 * Platform      : all
 *
 * Description   : This event script periodically checks for root user sessions logged in
 * via out-of-band console that have been idle for 15 minutes or more, and terminates the session.
 *
 */

version 1.0;

ns junos = "http://xml.juniper.net/junos/*/junos";
ns xnm = "http://xml.juniper.net/xnm/1.1/xnm";
ns jcs = "http://xml.juniper.net/junos/commit-scripts/1.0";

import "../import/junos.xsl";

var $event-definition = {
  <event-options> {
    <generate-event> {
      <name> "5-minute-delay";
      <time-interval> "300";
    }
    <policy> {
      <name> "terminate-idle-root";
      <events> "5-minute-delay";
      <then> {
        <event-script> {
          <name> "terminate-idle-root.slax";
        }
      }
    }
  }
}

match / {
    <op-script-results> {

      var $root_user = "root";
      var $idle_time = "900";
      var $from = "-";

      var $show-system-users-output = <get-system-users-information>;
      var $show-system-users = jcs:invoke($show-system-users-output);

      for-each ($show-system-users/uptime-information/user-table/user-entry) {
          var $user_check = ./user;
          var $idle_time_check = ./idle-time/@junos:seconds;
          var $from_check = ./from;
          var $tty = ./tty;
              if ($user_check == $root_user && $idle_time_check >= $idle_time && $from_check == $from) {
                  var $terminate_root_console = <command> "request system logout terminal " _ $tty;
                  expr jcs:invoke($terminate_root_console);
              }
      }
    }
}

Applying the Script:

If the commit is successful, it means that the script's syntax is valid.

jhead@VPN-EP1> configure exclusive
warning: uncommitted changes will be discarded on exit
Entering configuration mode

[edit]
jhead@VPN-EP1# set event-options event-script file terminate-idle-root.slax

[edit]
jhead@VPN-EP1# commit and-quit
commit complete
Exiting configuration mode

Hope this helps, feel free to comment if anything is unclear and I'll be happy to update my answer.