STIGQter: STIG Summary: Solaris 10 X86 Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 22 Jan 2021:

Graphical desktop environments provided by the system must automatically lock after 15 minutes of inactivity and the system must require users to re-authenticate to unlock the environment.

DISA Rule

SV-220076r603266_rule

Vulnerability Number

V-220076

Group Title

SRG-OS-000029

Rule Version

GEN000500

Severity

CAT II

CCI(s)

• CCI-000057 - The information system initiates a session lock after the organization-defined time period of inactivity.

Weight

10

Fix Recommendation

Configure the CDE lock manager to lock your screen after a certain amount of inactive time. To configure the CDE lock manager to lock the screen after 15 minutes of inactive time, enter the following commands (be sure NOT to overwrite an existing file).
#
cp /usr/dt/config/C/sys.resources /etc/dt/config/C/sys.resources
# vi /etc/dt/config/C/sys.resources

Locate and add/uncomment/change the line to N=15.
dtsession*lockTimeout: <N>
dtsession*lockTimeout: 15

Log out of CDE and log back in to verify that the timeout is in effect.

The timeout parameter in /usr/openwin/lib/app-defaults/XScreenSaver and all users' .xscreensaver files should also be confirmed to be uncommented and set to 0:15:00.

Check Contents

Examine the dtsession timeout variable setting:

# cat /etc/dt/config/C/sys.resources | grep -i dtsession | grep -i lockTimeout
If the dtsession timeout is greater than 15, commented or does not exist, this is a finding.

Examine the Open Windows timeout settings, both global and for every user.

# cat /usr/openwin/lib/app-defaults/XScreenSaver | egrep -i '\*(lock|timeout):'
If the global Open Windows timeout is greater than 15 minutes, commented or does not exist, this is a finding. If the global lock setting is not true, this is a finding.

# cut -d: -f6 /etc/passwd | xargs -iX egrep -i '^(lock|timeout):' X/.xscreensaver
If the Open Windows timeout is greater than 15 minutes for any user, this is a finding. If the lock setting is not true for any user, this is a finding.

Vulnerability Number

V-220076

Documentable

False

Rule Version

GEN000500

Severity Override Guidance

Examine the dtsession timeout variable setting:

# cat /etc/dt/config/C/sys.resources | grep -i dtsession | grep -i lockTimeout
If the dtsession timeout is greater than 15, commented or does not exist, this is a finding.

Examine the Open Windows timeout settings, both global and for every user.

# cat /usr/openwin/lib/app-defaults/XScreenSaver | egrep -i '\*(lock|timeout):'
If the global Open Windows timeout is greater than 15 minutes, commented or does not exist, this is a finding. If the global lock setting is not true, this is a finding.

# cut -d: -f6 /etc/passwd | xargs -iX egrep -i '^(lock|timeout):' X/.xscreensaver
If the Open Windows timeout is greater than 15 minutes for any user, this is a finding. If the lock setting is not true for any user, this is a finding.

Check Content Reference

M

Target Key

4061

Comments