mediumsystemunverifiedrollback-safe

Set graphical session idle delay to 15 minutes or less

gdm-idle-delay · RHEL ≥ 8 · 1 impl

Description

RHEL 8 must automatically lock graphical user sessions after 15 minutes of inactivity. The idle-delay dconf setting must be set to 900 seconds (15 minutes) or less.

Rationale

Terminating inactive sessions after a set period reduces the exposure of unattended workstations. The session lock should activate automatically after 15 minutes of inactivity to prevent unauthorized access.

Check → Remediate

Checkcommand

if ! rpm -q gdm >/dev/null 2>&1; then exit 0; fi
val=$(gsettings get org.gnome.desktop.session idle-delay 2>/dev/null | grep -o '[0-9]*')
[ -n "$val" ] && [ "$val" -le 900 ]

expected_exit:: 0

Remediatedconf_set

schema:: org/gnome/desktop/session
key:: idle-delay
value:: 900
value_type:: uint32
file:: 00-screensaver

Framework references

STIG

V-258023 / RHEL-09-271065V-230352

NIST 800-53

AC-11CM-6

#gdm#graphical#idle#session-lock#stig