Detections
Analytics

1.7.4 Ensure GDM screen locks when the user is idle

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

GNOME Desktop Manager can make the screen lock automatically whenever the user is idle for some amount of time.

Setting a lock-out value reduces the window of opportunity for unauthorized user access to another user's session that has been left unattended.

Solution

- IF - A user profile is already created run the following commands to enable screen locks when the user is idle:

 # gsettings set org.gnome.desktop.screensaver lock-delay 5 # gsettings set org.gnome.desktop.session idle-delay 900

 Note:

 - gsettings commands in this section MUST be done from a command window on a graphical desktop or an error will be returned.
 - The system must be restarted after all gsettings configurations have been set in order for CIS-CAT Assessor to appropriately assess.
 - If the dconf database is not updating correctly due to umask requirements contain in the benchmark, then use (umask 0022 && gsetting set) commands from above to temporarily set umask ensuring that any files or directories created by gsettings will have the required permissions. - OR/IF- A user profile does not exist:

 - Create or edit the user profile in the /etc/dconf/profile/ and verify it includes the following:
user-db:user
 system-db:{NAME_OF_DCONF_DATABASE}

 Note: local is the name of a dconf database used in the examples.

 -

Create the directory /etc/dconf/db/local.d/ if it doesn't already exist:

 -

Create the key file /etc/dconf/db/local.d/00-screensaver to provide information for the local database:

Example key file:

 # Specify the dconf path
 [org/gnome/desktop/session]

 # Number of seconds of inactivity before the screen goes blank
 # Set to 0 seconds if you want to deactivate the screensaver.
 idle-delay=uint32 180

 # Specify the dconf path
 [org/gnome/desktop/screensaver]

 # Number of seconds after the screen is blank before locking the screen
 lock-delay=uint32 0

 Note: You must include the uint32 along with the integer key values as shown.

 - Run the following command to update the system databases:
# dconf update
 - Users must log out and back in again before the system-wide settings take effect.

See Also

https://workbench.cisecurity.org/benchmarks/18960

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(5), 800-53|AC-11, 800-53|AC-11(1), 800-53|AC-12, CSCv7|16.11

Plugin: Unix

Control ID: d01bf478f150515c98e400614316013abbca456f0ddbe7de5fe6deab1ecc0c08