The graphical login service provides the capability of logging into the system using an X-Windows type interface from the console. If graphical login access for the console is required, the service must be in local-only mode.
An XCCDF Rule
Description
<VulnDiscussion>Externally accessible graphical desktop software may open the system to remote attacks.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-216080r603268_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
The System Administrator profile is required:
Configure the X11 server for local system only graphics access.
# pfexec svccfg -s svc:/application/x11/x11-server setprop options/tcp_listen=false