graphical - Graphical login security controls¶

Deployer/Auditor notes¶

The tasks in the security role configure dconf to display a login banner each time a graphical session starts on the system. The default banner message set by the role is:

You are accessing a secured system and your actions will be logged along with identifying information. Disconnect immediately if you are not an authorized user of this system.

Deployers can customize this message by setting an Ansible variable:

security_enable_graphical_login_message_text: >
    This is a customized banner message.

In addition, deployers can opt out of displaying a login banner message by changing security_enable_graphical_login_message to no.

Deployer/Auditor notes¶

The security role configures a login banner for graphical logins using dconf. Deployers can opt out of this change by setting the following Ansible variable:

security_enable_graphical_login_message: no

The message is customized by setting another Ansible variable:

security_enable_graphical_login_message_text: >
    You are accessing a secured system and your actions will be logged along
    with identifying information. Disconnect immediately if you are not an
    authorized user of this system.

Deployer/Auditor notes¶

The STIG requires that graphical sessions are locked when the screensaver starts and that users must re-enter credentials to restore access to the system. The screensaver lock is enabled by default if dconf is present on the system.

Deployers can opt out of this change by setting an Ansible variable:

security_lock_session: no

Deployer/Auditor notes¶

The STIG requires that the screensaver appears when a session reaches a certain period of inactivity. The tasks will enable the screensaver for inactive sessions by default.

Deployers can opt out of this change by setting an Ansible variable:

security_lock_session_when_inactive: no

Deployer/Auditor notes¶

This control is implemented by the tasks for another control. Refer to the documentation for more details on the change and how to opt out:

• The operating system must initiate a screensaver after a 15-minute period of inactivity for graphical user interfaces. (V-71893)

Deployer/Auditor notes¶

This control is implemented by the tasks for another control. Refer to the documentation for more details on the change and how to opt out:

• The operating system must initiate a screensaver after a 15-minute period of inactivity for graphical user interfaces. (V-71893)

Deployer/Auditor notes¶

The STIG requires that a graphical session is locked when the screensaver starts. This requires a user to re-enter their credentials to regain access to the system.

The tasks will set a timeout of 5 seconds after the screensaver has started before the session is locked. This gives a user a few seconds to press a key or wiggle their mouse after the screensaver appears without needing to re-enter their credentials.

Deployers can adjust this timeout by setting an Ansible variable:

security_lock_session_screensaver_lock_delay: 5

Deployer/Auditor notes¶

If AutomaticLoginEnable=true exists in the gdm configuration file, /etc/gdm/custom.conf, the configuration will removed. This disallows automatic logins for gdm and requires a user to complete the username and password prompts.

Deployers can opt-out of this change by setting an Ansible variable:

security_disable_gdm_automatic_login: no

Deployer/Auditor notes¶

If TimedLoginEnable=true exists in the gdm configuration file, /etc/gdm/custom.conf, the configuration will removed. This disallows timed logins for guest users in gdm.

Deployers can opt-out of this change by setting an Ansible variable:

security_disable_gdm_timed_login: no

Deployer/Auditor notes¶

This control is implemented by the tasks for another control:

• The operating system must enable a user session lock until that user re-establishes access using established identification and authentication procedures. (V-71891)

Deployer/Auditor notes¶

This control is implemented by the tasks for another control:

• The operating system must enable a user session lock until that user re-establishes access using established identification and authentication procedures. (V-71891)