Detections
Analytics

2.1.20 Ensure a graphical user interface is not in use

Information

A graphical user interface (GUI) is the desktop environment through which users interact with the system using graphical windows and a graphical login. On this platform it is provided by the "Server with GUI" environment group, which installs the display server, a desktop environment, and a display manager such as the GNOME Display Manager (GDM). A system is using a graphical user interface when the "Server with GUI" environment group is installed and the system boots into the graphical target.

If a Graphical User Interface (GUI) is not required, it should be removed to reduce the attack surface of the system.

Solution

Run the following to remove the graphical user interface.

 - Install the "Minimal Install" group to satisfy dependencies (minimizing the impact of removing the graphical group):

# dnf groupinstall -y "Minimal Install"

 - Remove the "Server with GUI" environment group:

# dnf groupremove -y "Server with GUI"

 - Install the "Server" group:

# dnf groupinstall -y "Server"

 - Set the default target to multi-user and reboot:

# systemctl set-default multi-user.target
# reboot

- OR -

- IF - the graphical environment is required as a dependency but a graphical session is not needed, set the default target so the system does not boot into the graphical interface, then reboot:

# systemctl set-default multi-user.target
# reboot

Impact:

Removing the graphical user interface removes the ability to interact with the system through a local desktop and graphical login. A reboot is required for the change to take effect. Where a graphical interface is a documented operational requirement, this recommendation may not be applicable; before removing it, review any packages that depend on the graphical environment to determine whether they are required on the system.

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: af65aefb0579e0255ecde7f2a9c8a3c8a7e04b672b2aeedd96aa9e87c47c78d5