Recommendations
1.8 GNOME Display Manager
157 | P a g e
158 | P a g e References:
1. https://wiki.gnome.org/Projects/GDM CIS Controls:
Controls
Version Control IG 1 IG 2 IG 3
v8
4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software
Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing service, web application module, or service function.
● ●
v7 2.6 Address unapproved software
Ensure that unauthorized software is either removed or the inventory is updated in a timely manner
● ● ●
159 | P a g e
1.8.2 Ensure GDM login banner is configured (Automated)
Profile Applicability:
Level 1 - Server
Level 1 - Workstation
Description:
GDM is the GNOME Display Manager which handles graphical login for GNOME based systems.
Rationale:
Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place.
Note: If a graphical login is not required, it should be removed to reduce the attack surface of the system.
Audit:
Verify that /etc/dconf/profile/gdm exists and includes the following:
user-db:user system-db:gdm
file-db:/usr/share/gdm/greeter-dconf-defaults
Verify that a file exists in /etc/dconf/db/gdm.d/ and includes the following: (This is typically /etc/dconf/db/gdm.d/01-banner-message)
[org/gnome/login-screen]
banner-message-enable=true
banner-message-text='<banner message>'
160 | P a g e Remediation:
Edit or create the file /etc/dconf/profile/gdm and add the following:
user-db:user system-db:gdm
file-db:/usr/share/gdm/greeter-dconf-defaults
Edit or create the file /etc/dconf/db/gdm.d/ and add the following: (This is typically
/etc/dconf/db/gdm.d/01-banner-message)
[org/gnome/login-screen]
banner-message-enable=true
banner-message-text='<banner message>'
Example Banner Text: 'Authorized users only. All activity may be monitored and reported.' Run the following command to update the system databases:
# dconf update
Additional Information:
Additional options and sections may appear in the /etc/dconf/db/gdm.d/01-banner- message file.
If a different GUI login service is in use and required on the system, consult your documentation to disable displaying the last logged on user and apply an equivalent banner.
CIS Controls:
Controls
Version Control IG 1 IG 2 IG 3
v8
4.1 Establish and Maintain a Secure Configuration Process
Establish and maintain a secure configuration process for enterprise assets (end- user devices, including portable and mobile, non-computing/IoT devices, and servers) and software (operating systems and applications). Review and update documentation annually, or when significant enterprise changes occur that could impact this
Safeguard.
● ● ●
v7 5.1 Establish Secure Configurations
Maintain documented, standard security configuration standards for all authorized operating systems and software.
● ● ●
161 | P a g e
1.8.3 Ensure last logged in user display is disabled (Automated)
Profile Applicability:
Level 1 - Server
Level 1 - Workstation
Description:
GDM is the GNOME Display Manager which handles graphical login for GNOME based systems.
Rationale:
Displaying the last logged in user eliminates half of the Userid/Password equation that an unauthorized person would need to log on.
Warning messages inform users who are attempting to login to the system of their legal status regarding the system and must include the name of the organization that owns the system and any monitoring policies that are in place.
Notes:
If a graphical login is not required, it should be removed to reduce the attack surface of the system.
If a different GUI login service is in use and required on the system, consult your documentation to disable displaying the last logged on user
Audit:
Verify that /etc/dconf/profile/gdm exists and includes the following:
user-db:user system-db:gdm
file-db:/usr/share/gdm/greeter-dconf-defaults
Verify that a file exists in /etc/dconf/db/gdm.d/ and includes the following: (This is typically /etc/dconf/db/gdm.d/00-login-screen)
[org/gnome/login-screen]
disable-user-list=true
162 | P a g e Remediation:
Edit or create the file /etc/dconf/profile/gdm and add the following:
user-db:user system-db:gdm
file-db:/usr/share/gdm/greeter-dconf-defaults
Edit or create the file /etc/dconf/db/gdm.d/ and add the following: (This is typically
/etc/dconf/db/gdm.d/00-login-screen)
[org/gnome/login-screen]
# Do not show the user list disable-user-list=true
Run the following command to update the system databases:
# dconf update
CIS Controls:
Controls
Version Control IG 1 IG 2 IG 3
v8
4.1 Establish and Maintain a Secure Configuration Process
Establish and maintain a secure configuration process for enterprise assets (end- user devices, including portable and mobile, non-computing/IoT devices, and servers) and software (operating systems and applications). Review and update documentation annually, or when significant enterprise changes occur that could impact this
Safeguard.
● ● ●
v7 5.1 Establish Secure Configurations
Maintain documented, standard security configuration standards for all authorized operating systems and software.
● ● ●
163 | P a g e
1.8.4 Ensure XDMCP is not enabled (Automated)
Profile Applicability:
Level 1 - Server
Level 1 - Workstation
Description:
X Display Manager Control Protocol (XDMCP) is designed to provide authenticated access to display management services for remote displays
Rationale:
XDMCP is inherently insecure.
XDMCP is not a ciphered protocol. This may allow an attacker to capture keystrokes entered by a user
XDMCP is vulnerable to man-in-the-middle attacks. This may allow an attacker to steal the credentials of legitimate users by impersonating the XDMCP server.
Audit:
Run the following command and verify the output:
# grep -Eis '^\s*Enable\s*=\s*true' /etc/gdm/custom.conf Nothing should be returned
Remediation:
Edit the file /etc/gdm/custom.conf and remove the line
Enable=true
Default Value:
false (This is denoted by no Enabled= entry in the file /etc/gdm/custom.conf in the
[xdmcp] section References:
1. https://help.gnome.org/admin/gdm/2.32/configuration.html.en
164 | P a g e CIS Controls:
Controls
Version Control IG 1 IG 2 IG 3
v8
4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software
Uninstall or disable unnecessary services on enterprise assets and software, such as an unused file sharing service, web application module, or service function.
● ●
v7
9.2 Ensure Only Approved Ports, Protocols and Services Are Running
Ensure that only network ports, protocols, and services listening on a system with validated business needs, are running on each system.
● ●
165 | P a g e
1.8.5 Ensure automatic mounting of removable media is disabled (Automated)
Profile Applicability:
Level 1 - Server
Level 2 - Workstation
Description:
By default GNOME automatically mounts removable media when inserted as a convenience to the user.
Rationale:
With automounting enabled anyone with physical access could attach a USB drive or disc and have its contents available in system even if they lacked permissions to mount it themselves.
Impact:
The use of portable hard drives is very common for workstation users. If your organization allows the use of portable storage or media on workstations and physical access controls to workstations is considered adequate there is little value add in turning off automounting.
Audit:
Run the following command to verify automatic mounting is disabled:
# gsettings get org.gnome.desktop.media-handling automount false
Verify result is "false".
166 | P a g e Remediation:
Ensure that automatic mounting of media is disabled for all GNOME users:
# cat << EOF >> /etc/dconf/db/local.d/00-media-automount [org/gnome/desktop/media-handling]
automount=false automount-open=false EOF
Apply the changes with:
# dconf update
References:
1. https://access.redhat.com/solutions/20107 CIS Controls:
Controls
Version Control IG 1 IG 2 IG 3
v8
10.3 Disable Autorun and Autoplay for Removable Media
Disable autorun and autoplay auto-execute functionality for removable media.
● ● ●
v7 8.5 Configure Devices Not To Auto-run Content
Configure devices to not auto-run content from removable media.
● ● ●
167 | P a g e