STIGQter: STIG Summary: Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 10 Mar 2021:

The Ubuntu operating system must retain a user's session lock until that user reestablishes access using established identification and authentication procedures.

DISA Rule

SV-238199r653772_rule

Vulnerability Number

V-238199

Group Title

SRG-OS-000028-GPOS-00009

Rule Version

UBTU-20-010004

Severity

CAT II

CCI(s)

• CCI-000056 - The information system retains the session lock until the user reestablishes access using established identification and authentication procedures.
• CCI-000057 - The information system initiates a session lock after the organization-defined time period of inactivity.

Weight

10

Fix Recommendation

Configure the Ubuntu operating system to allow a user to lock the current graphical user interface session.

Note: If the Ubuntu operating system does not have a graphical user interface installed, this requirement is Not Applicable.

Set the "lock-enabled" setting to allow graphical user interface session locks with the following command:

$ sudo gsettings set org.gnome.desktop.screensaver lock-enabled true

Check Contents

Verify the Ubuntu operation system has a graphical user interface session lock enabled.

Note: If the Ubuntu operating system does not have a graphical user interface installed, this requirement is Not Applicable.

Get the "lock-enabled" setting to verify the graphical user interface session has the lock enabled with the following command:

$ sudo gsettings get org.gnome.desktop.screensaver lock-enabled

true

If "lock-enabled" is not set to "true", this is a finding.

Vulnerability Number

V-238199

Documentable

False

Rule Version

UBTU-20-010004

Severity Override Guidance

Verify the Ubuntu operation system has a graphical user interface session lock enabled.

Note: If the Ubuntu operating system does not have a graphical user interface installed, this requirement is Not Applicable.

Get the "lock-enabled" setting to verify the graphical user interface session has the lock enabled with the following command:

$ sudo gsettings get org.gnome.desktop.screensaver lock-enabled

true

If "lock-enabled" is not set to "true", this is a finding.

Check Content Reference

M

Target Key

5318

Comments