Configure the tmux lock session key binding

An XCCDF Rule

Description

To set a key binding for the screen locking in tmux terminal multiplexer, the session-lock command must be bound to a key. Add the following line to /etc/tmux.conf:

bind X lock-session

. The console can now be locked with the following key combination:

Ctrl+b Shift+x

Rationale

The tmux package allows for a session lock to be implemented and configured. However, the session lock is implemented by an external command. The tmux default configuration does not contain an effective session lock.

ID: xccdf_org.ssgproject.content_rule_configure_tmux_lock_keybinding
Severity: Low
References: CCI-000056

SRG-OS-000028-GPOS-00009 SRG-OS-000030-GPOS-00011

OL08-00-020040

SV-248675r902786_rule
Updated: about 1 year ago

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && { rpm --quiet -q tmux; }; then

tmux_conf="/etc/tmux.conf"

if ! grep -qP '^\s*bind\s+\w\s+lock-session' "$tmux_conf" ; then    echo "bind X lock-session" >> "$tmux_conf"
fi
chmod 0644 "$tmux_conf"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - DISA-STIG-OL08-00-020040
  - configure_strategy  - configure_tmux_lock_keybinding
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed

- name: Check for duplicate values
  lineinfile:
    path: /etc/tmux.conf
    create: true
    regexp: \s*bind\s+\w\s+lock-session.*$
    mode: '0644'
    state: absent
  check_mode: true
  changed_when: false
  register: dupes
  when:
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - '"tmux" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL08-00-020040
  - configure_strategy
  - configure_tmux_lock_keybinding
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed

- name: Deduplicate values from /etc/tmux.conf
  lineinfile:
    path: /etc/tmux.conf
    create: true
    regexp: \s*bind\s+\w\s+lock-session.*$
    mode: '0644'
    state: absent
  when:
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - '"tmux" in ansible_facts.packages'
  - dupes.found is defined and dupes.found > 1
  tags:
  - DISA-STIG-OL08-00-020040
  - configure_strategy
  - configure_tmux_lock_keybinding
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed

- name: Insert correct line into /etc/tmux.conf
  lineinfile:
    path: /etc/tmux.conf
    create: true
    regexp: \s*bind\s+\w\s+lock-session.*$
    mode: '0644'
    line: bind X lock-session
    state: present
  when:
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - '"tmux" in ansible_facts.packages'
  tags:
  - DISA-STIG-OL08-00-020040
  - configure_strategy
  - configure_tmux_lock_keybinding
  - low_complexity
  - low_disruption
  - low_severity
  - no_reboot_needed

Configure the tmux lock session key binding

Description

Rationale

Remediation - Shell Script

Remediation - Ansible