cis-ubuntu2004-v300-1-7-4

name	cis-ubuntu2004-v300-1-7-4
description	Ensure GDM screen locks when the user is idle
category	cis-networking
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","gnome","gdm","screen-lock","idle"]
cis_id	1.7.4
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

1.7.4 Ensure GDM screen locks when the user is idle (Automated)

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

GNOME Desktop Manager can make the screen lock automatically whenever the user is idle for some amount of time.

Rationale

Setting a lock-out value reduces the window of opportunity for unauthorized user access to another user's session that has been left unattended.

Audit Procedure

Command Line

Run the following command to verify that a user profile exists:

# grep -Psi "user-db|system-db" /etc/dconf/profile/*/*

/etc/dconf/profile/local:user-db:user
/etc/dconf/profile/local:system-db:local

Run the following commands to verify that the screen locks when the user is idle:

# gsettings get org.gnome.desktop.screensaver lock-delay
uint32 5
# gsettings get org.gnome.desktop.session idle-delay
uint32 900
# gsettings get org.gnome.desktop.screensaver lock-enabled
true

Notes:

• lock-delay=uint32 {n} - should be 5 seconds or less and follow local site policy
• idle-delay=uint32 {n} - Should be 900 seconds (15 minutes) or less, not 0 (disabled) and follow local site policy
• lock-enabled - must be set to true for screen locks to lock when the user is idle

Expected Result

• lock-delay should be 5 seconds or less
• idle-delay should be 900 seconds or less (not 0)
• lock-enabled should be true

Remediation

Command Line

• IF - A user profile is already created run the following commands to enable screen locks when the user is idle:

# gsettings set org.gnome.desktop.screensaver lock-delay 5
# gsettings set org.gnome.desktop.session idle-delay 900
# gsettings set org.gnome.desktop.screensaver lock-enabled true

Note: