SV-48550r1: The graphical desktop environment must set the idle timeout to no more than 15 minutes. | Red Hat Enterprise Linux 5 Security Technical Implementation Guide

Loading benchmark…

Assessment Title

Rule Text

The graphical desktop environment must set the idle timeout to no more than 15 minutes.

Description

Discussion Text

If graphical desktop sessions do not lock the session after 15 minutes of inactivity, requiring re-authentication to resume operations, the system or individual data could be compromised by an alert intruder who could exploit the oversight. This requirement applies to graphical desktop environments provided by the system to locally attached displays and input devices as well as to graphical desktop environments provided to remote systems, including thin clients.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000057

Additional Details

Responsibility

System Administrator

References

DPMS Target Red Hat 5 DISA DPMS Target Red Hat 5 2154

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.fso.rhel11:def:458
# The graphical desktop environment must set the idle timeout to no more than 15 minutes.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.

# idle_delay <= 15 but not 0
# xmlfilecontent_object (xmlfilecontent_test)
test_1() {
  (xmllint --xpath '/gconf/entry[@name='\''idle_delay'\'']/@value' '/etc/gconf/gconf.xml.mandatory/apps/gnome-screensaver/%gconf.xml' 2>/dev/null | sed -E 's/^[^=]+="//; s/"$//') | grep -Pq '^[1-9]$|^1[0-5]$'
}
# X Windows package is not installed
# rpminfo_object (rpminfo_test)
test_2() {
  ! ( rpm -q --quiet 'xorg-x11-server-Xorg' &>/dev/null )
}

if ! ( test_1 || test_2 ); then
  echo "PASS"
else
  echo "FAIL"
fi

Assessment Script Powered by AISandbox-executed

A standalone Shell script to assess this control automatically. Review before running it in your environment.

Syntax-checked and actually executed in an isolated sandbox (not the real system this checks) — confirmed to run without errors.

#!/bin/sh
# DISA STIG / SCAP compliance check for idle timeout (oval:mil.disa.fso.rhel11:def:458)

if ! command -v rpm &> /dev/null; then
    echo "PASS"
    exit 0
fi

if [ ! -f "/etc/gconf/gconf.xml.mandatory" ]; then
    echo "PASS"
    exit 0
fi

idle_delay=$(xmllint --xpath 'string(/gconf/entry[@name="idle_delay"]/@value)' /etc/gconf/gconf.xml.mandatory)

if [ "$idle_delay" ] && [[ $idle_delay =~ ^[1-9]$|^1[0-5]$ ]]; then
    echo "PASS"
    exit 0
else
    echo "FAIL"
    exit 1
fi

Remediation

For the Gnome screen saver, set idle_delay to 15.

Procedure:
# gconftool-2 --direct --config-source xml:readwrite:/etc/gconf/gconf.xml.mandatory --type int --set /apps/gnome-screensaver/idle_delay 15