Ah, I didn't realize that there were MLS hooks in there. That makes more sense considering that the 800-53 requires a CC evaluation for all Federally utilized products.

Could the prose in the SSG be updated to refer to what exactly needs to be done on the user side? Do we need to intstall the cc-config-rhel71 package on all systems to meet this requirement or is there some subset that we can apply? In that vein, should the STIG require that the cc-config-rhel71 package be applied?

As it stands, 'install screen' really doesn't tell me a lot about what I need to force the users to actually *do* with screen which, thanks to this thread, I now have (and am quite pleased with).

As a side note, finding the cc-config-rhel71 package is really non-trivial.

Thanks,

Trevor


On Tue, Nov 14, 2017 at 3:15 PM, Steve Grubb <sgrubb@redhat.com> wrote:
On Tuesday, November 14, 2017 10:27:04 AM EST Trevor Vaughan wrote:
> Steve,
>
> So, would tmux be a valid alternative? It can do the same as screen in that
> respect.

I remember that we had to make screen MLS aware. No such work has been done to
tmux. It was not part of the TOE and therefore not subjected to the review and
bug fixing that screen got. Not saying it couldn't be...it just hasn't been
through CC to verify how it works.

> Also, either case is going to leave the base VT wide open and able to be
> connected to fairly easily.

That is a requirement. If you have a multi user system, they need to
independently work and time out independently.

> Would using an Exit Trap with TMOUT to spawn vlock work?

What if you're sitting in vi editing a daemon config and get a long phone
call? It has to be independent of bash.

> That should work in all cases (well, for bash and zsh anyway). This would
> also seem to be more in line with the requirement since a 'vlock -a' will
> lock *all* user terminals, not just one.

:-)  Which I'm sure will make the other users real happy. The correct use and
configuration for screen can be found in the cc-config-rhel71 package with
lots of other guidance on how to meet requirements.

-Steve

> On Mon, Nov 13, 2017 at 3:03 PM, Steve Grubb <sgrubb@redhat.com> wrote:
> > On Monday, November 13, 2017 1:02:00 PM EST Trevor Vaughan wrote:
> > > Is there a reason that 'screen' was chosen over or 'vlock' for
> > > xccdf_org.ssgproject.content_rule_package_screen_installed?
> >
> > Common Criteria requirements state that we need to have a self locking
> > screen
> > after a certain number of minutes of inactivity. Screen can do it, vlock
> > can't.
> >
> > -Steve
> >
> > > 'vlock' is the more target specific and allows for locking *all* user
> > > consoles by running 'vlock -a'.
> > >
> > > Thanks,
> > >
> > > Trevor





--
Trevor Vaughan
Vice President, Onyx Point, Inc
(410) 541-6699 x788

-- This account not approved for unencrypted proprietary information --