mediumservicesunverifiedrollback-safe

Ensure GDM screen locks when the user is idle

gdm-screen-lock-idle · RHEL ≥ 8 · 1 impl

Description

If GNOME Display Manager is in use, the screen should lock automatically after a period of inactivity.

Rationale

Automatic screen locking prevents unauthorized access when users leave their workstations unattended.

Check → Remediate

Checkcommand

# Check if idle lock is configured
if grep -qr "idle-delay=uint32" /etc/dconf/db/local.d/ 2>/dev/null &&
   grep -qr "lock-delay=uint32" /etc/dconf/db/local.d/ 2>/dev/null; then
  echo "OK: GDM screen lock on idle is configured"
  exit 0
fi
echo "FAIL: GDM screen lock on idle is not configured"
exit 1

expected_exit:: 0

Remediatedconf_set

schema:: org/gnome/desktop/session
key:: idle-delay
value:: 900
value_type:: uint32
file:: 00-screensaver

Framework references

CIS

rhel9 1.8.4rhel8 1.8.3rhel10 1.8.3

NIST 800-53

AC-11

#gdm#gnome#screen-lock#security