SV-216101r958400: The system must require users to re-authenticate to unlock a graphical desktop environment. | Solaris 11 X86 STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The system must require users to re-authenticate to unlock a graphical desktop environment.

Description

Discussion Text

Allowing access to a graphical environment when the user is not attending the system can allow unauthorized users access to the system.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000056V-48045SV-60917

References

DPMS Target Solaris 11 X86 DISA DPMS Target Solaris 11 X86 4021

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.solaris11:def:44
# The system must require users to re-authenticate to unlock a graphical desktop environment.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
#   - textfilecontent54_object (textfilecontent54_test) -- Each user's .xscreensaver must have a lock field set to true.: no extractor for field "subexpression"
#   - textfilecontent54_object (textfilecontent54_test) -- Each user's .xscreensaver must have a lockTimeout of 5 seconds.: no extractor for field "subexpression"
#   - textfilecontent54_object (textfilecontent54_test) -- Each user's .xscreensaver must have a timeout of 15 minutes.: no extractor for field "subexpression"

# Check to see if CDM is being run by the system.
# smf_object (smf_test)
test_1() {
  (svcs -H -o state 'svc://localhost/application/graphical-login/gdm:default') | grep -qxF 'ONLINE'
}
# Check to see if XDM is being run by the system.
# smf_object (smf_test)
test_2() {
  (svcs -H -o state 'svc://localhost/application/graphical-login/xdm:default') | grep -qxF 'ONLINE'
}
# XScreenSaver must have a timeout of 15 minutes.
# textfilecontent54_object (textfilecontent54_test)
test_3() {
  (sed -En 's/^\s*\*timeout:\s*(\S+)\s*$/\1/p' '/usr/share/X11/app-defaults/XScreenSaver') | grep -Pq '(?:0:15:00|0:1[0-4]:[0-5][0-9]|0:0[0-9]:[0-5][0-9])'
}
# XScreenSaver must have a lockTimeout of 0:00:05.
# textfilecontent54_object (textfilecontent54_test)
test_4() {
  (sed -En 's/^\s*\*lockTimeout:\s*(\S+)\s*$/\1/p' '/usr/share/X11/app-defaults/XScreenSaver') | grep -Pq '0:00:0[0-5]'
}
# XScreenSaver must have a lock field set to true.
# textfilecontent54_object (textfilecontent54_test)
test_5() {
  (sed -En 's/^\s*\*lock:\s*(\S+)\s*$/\1/p' '/usr/share/X11/app-defaults/XScreenSaver') | grep -qxF 'True'
}

if ( test_1 || test_2 || ( test_3 && test_4 && test_5 ) ); then
  echo "PASS (automated portion only -- MANUAL REVIEW still required, see notes above)"
else
  echo "FAIL (or see MANUAL REVIEW note above)"
fi

Remediation

The root role is required.

Edit the global screensaver configuration file to ensure 15 minute screen lock.

# pfedit /usr/share/X11/app-defaults/XScreenSaver

Find the timeout control lines and change them to read:

*timeout: 0:15:00
*lockTimeout: 0:00:05
*lock: True

For each user on the system, edit their local $HOME/.xscreensaver file and change the timeout values.

# pfedit $HOME/.xscreensaver

Find the timeout control lines and change them to read:

timeout: 0:15:00
lockTimeout: 0:00:05
lock: True