cis-ubuntu1604-v200-1-8-4

name	cis-ubuntu1604-v200-1-8-4
description	Ensure XDCMP is not enabled
category	cis-networking
version	2.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-16.04","xdmcp","gdm","gnome","remote-display","display-manager"]
cis_id	1.8.4
cis_benchmark	CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0 - 1.8.4

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

X Display Manager Control Protocol (XDMCP) is designed to provide authenticated access to display management services for remote displays.

Rationale

XDMCP is inherently insecure.

• XDMCP is not a ciphered protocol. This may allow an attacker to capture keystrokes entered by a user.
• XDMCP is vulnerable to man-in-the-middle attacks. This may allow an attacker to steal the credentials of legitimate users by impersonating the XDMCP server.

Audit Procedure

Command Line

Run the following command and verify the output:

grep -Eis '^\s*Enable\s*=\s*true' /etc/gdm3/custom.conf

Nothing should be returned.

Expected Result

No output should be returned, indicating XDMCP is not enabled.

Remediation

Command Line

Edit the file /etc/gdm3/custom.conf and remove the line:

Enable=true

Default Value

false (This is denoted by no Enabled= entry in the file /etc/gdm3/custom.conf in the [xdmcp] section)

References

None.

CIS Controls

Controls Version	Control
v7	9.2 Ensure Only Approved Ports, Protocols and Services Are Running

Assessment Status

Automated