In the good old days there used to be a Unix program called "idled" that would log out idle users after warning them. It was really configurable and generally did the right thing.
Unfortunately it's no longer maintained and the original source no longer exists.
Before I pull it out of old RPMs or openbsd ports, does anyone know if idled's been maintained elsewhere, or if there's some alternative I should be looking at instead?
The simple way is to set TMOUT in bash for your users (in /etc/profile or something). Yes, they can work around it, but I'm sure they can work around anything.
It still exists, although these days it's called doinkd
https://sourceforge.net/projects/idled/