OpenControls Logo

STIG Viewer

STIGViewer Support

The system must require users to re-authenticate to unlock a graphical desktop environment.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-216101SOL-11.1-040170SV-216101r958400_ruleCCI-000056medium
Description
Allowing access to a graphical environment when the user is not attending the system can allow unauthorized users access to the system.
STIGDate
Solaris 11 X86 Security Technical Implementation Guide2026-05-13

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-24Session Lock
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (15) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-11Device Lock
1.00
AC-11(1)Pattern-hiding Displays
1.00
AC-12Session Termination
1.00
AU-10Non-repudiation
1.00
IA-2Identification and Authentication (Organizational Users)
1.00
IA-2(1)Multi-factor Authentication to Privileged Accounts
1.00
IA-2(12)Acceptance of PIV Credentials
1.00
IA-2(2)Multi-factor Authentication to Non-privileged Accounts
1.00
IA-2(3)Local Access to Privileged Accounts
1.00
IA-2(4)Local Access to Non-privileged Accounts
1.00

+5 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.10
1.00
CCI1 mapping
CCI-000056
1.00

Details

Check Text (C-216101r958400_chk)

If the system is not running XWindows, this check does not apply. Determine if the screen saver timeout is configured properly. # grep "^\*timeout:" /usr/share/X11/app-defaults/XScreenSaver If the output is not: *timeout: 0:15:00 or a shorter time interval, this is a finding. # grep "^\*lockTimeout:" /usr/share/X11/app-defaults/XScreenSaver If the output is not: *lockTimeout: 0:00:05 or a shorter time interval, this is a finding. # grep "^\*lock:" /usr/share/X11/app-defaults/XScreenSaver If the output is not: *lock: True this is a finding. For each existing user, check the configuring of their personal .xscreensaver file. # grep "^timeout:" $HOME/.xscreensaver If the output is not: timeout: 0:15:00 or a shorter time interval, this is a finding. # grep "^lockTimeout:" $HOME/.xscreensaver If the output is not: lockTimeout: 0:00:05 or a shorter time interval, this is a finding. # grep "^lock:" $HOME/.xscreensaver If the output is not: lock: True this is a finding.

Fix Text (F-17337r372686_fix)

The root role is required. Edit the global screensaver configuration file to ensure 15 minute screen lock. # pfedit /usr/share/X11/app-defaults/XScreenSaver Find the timeout control lines and change them to read: *timeout: 0:15:00 *lockTimeout: 0:00:05 *lock: True For each user on the system, edit their local $HOME/.xscreensaver file and change the timeout values. # pfedit $HOME/.xscreensaver Find the timeout control lines and change them to read: timeout: 0:15:00 lockTimeout: 0:00:05 lock: True