Title

An X Windows display manager must not be installed unless approved. (Cat II impact)

Discussion

Internet services that are not required for system or application processes must not be active to decrease the attack surface of the system. X Windows has a long history of security vulnerabilities and will not be used unless approved and documented.

Check Content

Verify that if X Windows is installed it is authorized. Check for the X11 package with the following command: # dpkg -l | grep lightdm Ask the System Administrator if use of the X Windows system is an operational requirement. If the use of X Windows on the system is not documented with the Information System Security Officer (ISSO), this is a finding.

Fix Text

Document the requirement for an X Windows server with the Information System Security Officer (ISSO) or remove the related packages with the following commands: # sudo apt-get purge lightdm

Additional Identifiers

Rule ID: SV-215160r610931_rule

Vulnerability ID: V-215160

Group Title: SRG-OS-000480-GPOS-00227

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.