SV-248679r1015046: OL 8 must be able to initiate directly a session lock for all connection types using smartcard when the smartcard is removed. | Oracle Linux 8 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

OL 8 must be able to initiate directly a session lock for all connection types using smartcard when the smartcard is removed.

Description

Discussion Text

A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity of the information system but does not want to log out because of the temporary nature of the absence. The session lock is implemented at the point where session activity can be determined. Regardless of where the session lock is determined and implemented, once invoked, the session lock must remain in place until the user reauthenticates. No other activity aside from reauthentication must unlock the system. OL 8 includes "authselect" as a tool to configure system identity, authentication sources, and providers by selecting a specific profile. A profile is a set of files that describes the resulting system configuration. When a profile is selected, "authselect" will create the "nsswitch.conf" and "PAM" stack to use identity and authentication sources defined by the profile. Satisfies: SRG-OS-000028-GPOS-00009, SRG-OS-000030-GPOS-00011

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000056Not mappedCCI-000057Not mappedCCI-000058

References

DPMS Target Oracle Linux 8 DISA DPMS Target Oracle Linux 8 5416

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# OVAL Definition: oval:mil.disa.stig.ol8os:def:248679


if [ ! -d "/etc/dconf/db" ]; then
  echo "FAIL"
  exit 1
fi

dconf_file=$(find /etc/dconf/db -type f -name "*.dconf")

if [ -z "$dconf_file" ]; then
  echo "PASS"
  exit 0
fi

grep -q "^[org/gnome/settings-daemon/peripherals/smartcard]" "$dconf_file" && \
grep -q "removal-action='lock-screen'" "$dconf_file" && \
echo "PASS" && exit 0

echo "FAIL"
exit 1

Remediation

Configure OL 8 to enable a user's session lock until that user reestablishes access using established identification and authentication procedures. 
 
Select/create an "authselect" profile and incorporate the "with-smartcard-lock-on-removal" feature as in the following example: 
 
$ sudo authselect select sssd with-smartcard with-smartcard-lock-on-removal 
 
Alternatively, the "dconf" settings can be edited in the "/etc/dconf/db/*" location. 
 
Edit or add the "[org/gnome/settings-daemon/peripherals/smartcard]" section of the database file and add or update the following line: 
 
removal-action='lock-screen' 
 
Update the system databases: 
 
$ sudo dconf update