Prevent user from disabling the screen lock
An XCCDF Rule
Description
The tmux terminal multiplexer is used to implement
automatic session locking. It should not be listed in
/etc/shells.
Rationale
Not listing tmux among permitted shells
prevents malicious program running as user
from lowering security by disabling the screen lock.
- ID
- xccdf_org.ssgproject.content_rule_no_tmux_in_shells
- Severity
- Low
- References
- Updated
Remediation - Kubernetes Patch
---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
config:
ignition:
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
if grep -q 'tmux\s*$' /etc/shells ; then
sed -i '/tmux\s*$/d' /etc/shells
fi