auto-logout:

http://plone.org/support/forums/general#nabble-td3673185

session-timeout setting in zope.conf

. .

Jim is right.  Setting the session-timeout-minutes variable in zope.conf does it.  

session-timeout-minutes can also be set in temp_folder/session_data in the ZMI, but to no avail: on the next restart of Zope it reverts to what's in zope.conf (if anything is there) or else back to the default (20 minutes).

I did learn from the ZMI that you can disable the timeout entirely by setting session-timeout-minutes to 0.  I did that and also set the  session-resolution-seconds to a high number, so it doesn't degrade performance by checking frequently.

It's too bad this isn't all documented in one place.  The best single source I've found is the Zope Book, http://docs.zope.org/zope2/zope2book/source/Sessions.html#configuration-and-operation, which covers it all except the 0-to-disable trick.

better with this:

http://pypi.python.org/pypi/plone.session/