Detections
Analytics

2.4.3.4 Ensure systemd user timers disable-linger is configured

Information

systemd timers can also be used by regular users. As with other systemd services started as a regular user, user timers only run when the user is logged in. If linger is enabled for a specific user, a user manager is spawned for the user at boot and kept around after logouts. This allows users who are not logged in to run long-running services.

Disabling systemd user lingering prevents user-level services and timers from running with the user is not logged in. This reduces the risk of unauthorized persistence and ensures scheduled background tasks execute only during active user sessions unless explicitly approved.

Solution

Run the following command to set disable-linger :

# loginctl disable-linger <username>

See Also

https://workbench.cisecurity.org/benchmarks/26236

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|CM-7, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 17053bbce293973cf29b215af670b6a47d7f8a278c206ca3e722df723cf47bee