cis-ubuntu1804-v220-1-8-4

name	cis-ubuntu1804-v220-1-8-4
description	Ensure GDM screen locks when the user is idle
category	cis-networking
version	2.2.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-18.04","gdm","gnome","screen-lock","idle","dconf"]
cis_id	1.8.4
cis_benchmark	CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

1.8.4 Ensure GDM screen locks when the user is idle (Automated)

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

GNOME Desktop Manager can make the screen lock automatically whenever the user is idle for some amount of time.

• idle-delay=uint32 {n} - Number of seconds of inactivity before the screen goes blank
• lock-delay=uint32 {n} - Number of seconds after the screen is blank before locking the screen

Example key file:

# Specify the dconf path
[org/gnome/desktop/session]

# Number of seconds of inactivity before the screen goes blank
# Set to 0 seconds if you want to deactivate the screensaver.
idle-delay=uint32 900

# Specify the dconf path
[org/gnome/desktop/screensaver]

# Number of seconds after the screen is blank before locking the screen
lock-delay=uint32 5

Rationale

Setting a lock-out value reduces the window of opportunity for unauthorized user access to another user's session that has been left unattended.

Audit Procedure

Command Line

Run the following script to verify that the screen locks when the user is idle:

#!/usr/bin/env bash

{
    # Check if GNOME Desktop Manager is installed. If package isn't installed, recommendation is Not Applicable\n
    # determine system's package manager
    l_pkgoutput=""
    if command -v dpkg-query > /dev/null 2>&1; then
        l_pq="dpkg-query -s"
    elif command -v rpm > /dev/null 2>&1; then
        l_pq="rpm -q"
    fi
    # Check if GDM is installed
    l_pcl="gdm gdm3" # Space separated list of packages to check
    for l_pn in $l_pcl; do
        $l_pq "$l_pn" > /dev/null 2>&1 && l_pkgoutput="\n - Package: \"\" exists on the system\n - checking configuration"
    
    
     [ -n  ]; 
        l_output= l_output2=
        l_idmv= 
        l_ldmv= 
        
        l_kfile= 
         [ -n  ]; 
            
            l_profile=. 
            l_pdbdir= 
            
            l_idv=
             [ -n  ]; 
                [  -gt  -a  -le  ] && l_output=
                [  =  ] && l_output2=
                [  -gt  ] && l_output2=
            
                l_output2=
            
            
            l_ldv=
             [ -n  ]; 
                [  -ge  -a  -le  ] && l_output=
                [  -gt  ] && l_output2=
            
                l_output2=
            
            
             grep -Psq  /etc/dconf/profile/*; 
                l_output=
            
                l_output2=
            
            
             [ -f  ]; 
                l_output=
            
                l_output2=
            
        
            l_output2=
        
    
        l_output=
    
    
    [ -n  ] &&  -e 
     [ -z  ]; 
         -e 
    
         -e 
        [ -n  ] &&  -e 
    
}