Detections
Analytics

4.6.1.7 Ensure CDE screensaver lock is enabled

Information

The timeout of keyboard and mouse inactivity before a password protected screensaver is invoked by the CDE session manager should be explicitly configured.

The default timeout of 30 minutes prior to a password protected screensaver being invoked is too long. The recommendation is to set this to 15 minutes or less to protect from unauthorized access on unattended systems.

Solution

Set the default timeout parameters dtsession*saverTimeout: and dtsession*lockTimeout :

for file in /usr/dt/config/*/sys.resources; do
 etc_file=`echo $file | sed -e s/usr/etc/`
 echo "\nupdating config file "$etc_file"..."
 if [[ ! -f $etc_file ]]; then
 dir=`dirname $file | sed -e s/usr/etc/`
 mkdir -p $dir
 cp $file $etc_file
 fi

 cp $etc_file $etc_file.bak
 grep -v 'dtsession\*saverTimeout:' $etc_file > $etc_file.sav
 grep -v 'dtsession\*lockTimeout:' $etc_file.sav > $etc_file
 echo 'dtsession*saverTimeout: 15' >> $etc_file
 echo 'dtsession*lockTimeout: 15' >> $etc_file
 rm $etc_file.sav
done

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(5), 800-53|AC-11, 800-53|AC-11(1), 800-53|AC-12, CSCv7|16.11, Rule-ID|SV-215318r958402_rule

Plugin: Unix

Control ID: 5ebf45264347650a23b85e54e61933ee80823a7a58380772e7c8ac9f1b9e186e