topic Re: setting default lock screen saver timeout CIS security assessment in Operating System - HP-UX

setting default lock screen saver timeout CIS security assessment

Vincent_5 — Thu, 22 Feb 2018 14:27:13 GMT

Hi Guys,

Can someone help im trying to harden my server with the script below from cis security on lock screen timeout

for file in /usr/dt/config/*/sys.resources; do dir="$(dirname "$file" | sed 's|^/usr/|/etc/|')" mkdir -p "$dir" echo 'dtsession*saverTimeout: 10' >>"$dir/sys.resources" echo 'dtsession*lockTimeout: 10' >>"$dir/sys.resources"done

After running the script . a sys.resources file is created with two line as below

dtsession*saverTimeout: 10

dtsession*lockTimeout: 10

but unfortunately the screensaver parameter still fail . Can someone help ??

Regards

Vincent

Re: setting default lock screen saver timeout CIS security assessment

Patrick Wallek — Thu, 22 Feb 2018 21:42:09 GMT

Did you check for a sys.resources file before you ran that command?

In my /usr/dt/config directory EACH subdirectory has its own sys.resources file and all of those sys.resources file has dtsession*lockTimeout and dtsession*saverTimeout already defined.

I'm not sure what the CIS script is looking for, but it may not be checking properly.

Re: setting default lock screen saver timeout CIS security assessment

Vincent_5 — Fri, 23 Feb 2018 04:46:13 GMT

Hi,
Thanks for the support, but is there a command I can check all the sys.resources file if the two lines are there . Kindly help

Regards
Vincent

Re: setting default lock screen saver timeout CIS security assessment

Patrick Wallek — Fri, 23 Feb 2018 14:35:29 GMT

Try this script. It will search the /usr/dt/config directory and look for sys.resources files. It will then check each file for the "dtsession*saverTimeout" and "dtsession*lockTimeout" lines.

for i in $(find /usr/dt/config -name sys.resources -print)
do
grep -q -e "dtsession\*saverTimeout" -e "dtsession\*lockTimeout" ${i}
if (( $? == 0 )) ; then
echo "File ${i} contains the saverTimeout and lockTimeout lines"
else
echo "File ${i} does NOT contain the saverTimeout and lockTimeout lines"
fi
done

If you want to see the lines each file contains, just remove the '-q' from the grep command.

Re: setting default lock screen saver timeout CIS security assessment

Vincent_5 — Sat, 24 Feb 2018 03:03:18 GMT

Hi,
Thanks for the script , but I believe I cannot just edit the sys.resources file and save it . It don't seems to be able to read it after I do changes to that file. Btw, can I check if there is a command I can remove all the sys.resources from /etc/dt/config/*/ . The intention is to run the script to harden . Pls advice

Regards
Vincent

Re: setting default lock screen saver timeout CIS security assessment

Patrick Wallek — Sat, 24 Feb 2018 03:55:24 GMT

>> but I believe I cannot just edit the sys.resources file and save it

Why not? They're all just text files as far as I can tell.

>>It don't seems to be able to read it after I do changes to that file

What can't read it? What error do you get?

>> ...can I check if there is a command I can remove all the sys.resources from /etc/dt/config/*/

Well, there's always the 'rm' command. This should remove all the sys.resources files, but if you're actually using any X-Windows, CDE, or anything then I"m not sure this will work well.

# rm /usr/dt/config/*/sys.resources

>>The intention is to run the script to harden

OK.

The last time I looked at the CIS script for HP-UX was 10 years ago, if not more. At that point in time they really didn't do a good job with writing the script for HP-UX. I recall that it didn't work well and the results it gave were not very accurate.