graphical - Graphical login security controls¶
Although most Linux servers only have text-based interfaces, graphical environments are required for certain applications. Security controls must be applied to these graphical environments to prevent unauthorized access.
Overview¶
The STIG requirements for graphical interfaces are focused on ensuring proper authentication for new sessions and enforcing re-authentication after idle periods.
These controls will be skipped on systems without a graphical login interface.
STIG requirements¶
All of the tasks for these STIG requirements are included in
tasks/rhel7stig/graphical.yml.
V-71859¶
Summary: The operating system must display the Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.
Severity: Medium
Implementation Status: Implemented
Deployer/Auditor notes¶
The tasks in the security role configure dconf to display a login banner
each time a graphical session starts on the system. The default banner message
set by the role is:
You are accessing a secured system and your actions will be logged along with identifying information. Disconnect immediately if you are not an authorized user of this system.
Deployers can customize this message by setting an Ansible variable:
security_enable_graphical_login_message_text: >
This is a customized banner message.
Warning
The dconf configuration does not support multi-line strings. Ensure that
security_enable_graphical_login_message_text contains a single line
of text.
In addition, deployers can opt out of displaying a login banner message by
changing security_enable_graphical_login_message to no.
V-71861¶
Summary: The operating system must display the approved Standard Mandatory DoD Notice and Consent Banner before granting local or remote access to the system via a graphical user logon.
Severity: Medium
Implementation Status: Implemented
Deployer/Auditor notes¶
The security role configures a login banner for graphical logins using
dconf. Deployers can opt out of this change by setting the following
Ansible variable:
security_enable_graphical_login_message: no
The message is customized by setting another Ansible variable:
security_enable_graphical_login_message_text: >
You are accessing a secured system and your actions will be logged along
with identifying information. Disconnect immediately if you are not an
authorized user of this system.
Note
The space available for the graphical banner is relatively short. Deployers should limit the length of their graphical login banners to the shortest length possible.
V-71891¶
Summary: The operating system must enable a user session lock until that user re-establishes access using established identification and authentication procedures.
Severity: Medium
Implementation Status: Implemented
Deployer/Auditor notes¶
The STIG requires that graphical sessions are locked when the screensaver
starts and that users must re-enter credentials to restore access to the
system. The screensaver lock is enabled by default if dconf is present on
the system.
Deployers can opt out of this change by setting an Ansible variable:
security_lock_session: no
V-71893¶
Summary: The operating system must initiate a screensaver after a 15-minute period of inactivity for graphical user interfaces.
Severity: Medium
Implementation Status: Implemented
Deployer/Auditor notes¶
The STIG requires that the screensaver appears when a session reaches a certain period of inactivity. The tasks will enable the screensaver for inactive sessions by default.
Deployers can opt out of this change by setting an Ansible variable:
security_lock_session_when_inactive: no
V-71895¶
Summary: The operating system must set the idle delay setting for all connection types.
Severity: Medium
Implementation Status: Implemented
Deployer/Auditor notes¶
This control is implemented by the tasks for another control. Refer to the documentation for more details on the change and how to opt out:
V-71899¶
Summary: The operating system must initiate a session lock for the screensaver after a period of inactivity for graphical user interfaces.
Severity: Medium
Implementation Status: Implemented
Deployer/Auditor notes¶
This control is implemented by the tasks for another control. Refer to the documentation for more details on the change and how to opt out:
V-71901¶
Summary: The operating system must initiate a session lock for graphical user interfaces when the screensaver is activated.
Severity: Medium
Implementation Status: Implemented
Deployer/Auditor notes¶
The STIG requires that a graphical session is locked when the screensaver starts. This requires a user to re-enter their credentials to regain access to the system.
The tasks will set a timeout of 5 seconds after the screensaver has started before the session is locked. This gives a user a few seconds to press a key or wiggle their mouse after the screensaver appears without needing to re-enter their credentials.
Deployers can adjust this timeout by setting an Ansible variable:
security_lock_session_screensaver_lock_delay: 5
V-71953¶
Summary: The operating system must not allow an unattended or automatic logon to the system via a graphical user interface.
Severity: High
Implementation Status: Implemented
Deployer/Auditor notes¶
If AutomaticLoginEnable=true exists in the gdm configuration file,
/etc/gdm/custom.conf, the configuration will removed. This disallows
automatic logins for gdm and requires a user to complete the username and
password prompts.
Deployers can opt-out of this change by setting an Ansible variable:
security_disable_gdm_automatic_login: no
V-71955¶
Summary: The operating system must not allow an unrestricted logon to the system.
Severity: High
Implementation Status: Implemented
Deployer/Auditor notes¶
If TimedLoginEnable=true exists in the gdm configuration file,
/etc/gdm/custom.conf, the configuration will removed. This disallows timed
logins for guest users in gdm.
Deployers can opt-out of this change by setting an Ansible variable:
security_disable_gdm_timed_login: no
V-73155¶
Summary: The operating system must set the lock delay setting for all connection types.
Severity: Medium
Implementation Status: Implemented
Deployer/Auditor notes¶
This control is implemented by the tasks for another control:
