RHEL AS4ux ScreenSaver for root

Joe_Wulf · 06-18-2007, 11:14 PM

I've been working (struggling?) to understand how to get the screensaver for root to function properly, lock the screen after so much time, etc......

Any and all help to get this to function is greatly appreciated.

R,
-Joe Wulf

brianmcgee · 06-19-2007, 09:12 AM

First of all it would be good to know if you are using any window manager (e. g. Gnome or KDE) or if you want to simply lock the console without X.

For console, screen may do the trick. You can lock the CLI with CTRL+A+X. Also vlock can be used to lock out people from an unattended terminal. if you use the bash shell you could use the timeout to lock you out after you leave the desk for a user defined time.

For example this will you logout from bash after 5minutes inactivity:

Code:

# export TMOUT=300

If you run screen, this session may be resumed.

If you use Gnome, the default window manager for RHEL4, you can access the settings for the screensaver with RedHat-(Applications)-Menu->Preferences->Screensaver. Set Blank Screen and Lock Out as desired.

A note from [1]:

Quote:

Don't log in as root.

Please note that xscreensaver works fine as a screen saver when you are logged in as root: it will not, however, lock your screen when you are logged in as root. This is for good and insurmountable security reasons.

In order for it to be safe for xscreensaver to be launched by xdm, certain precautions had to be taken, among them that xscreensaver never runs as root. In particular, if it is launched as root (as xdm is likely to do), xscreensaver will disavow its privileges, and switch itself to a safe user id (such as "nobody".)

An implication of this is that if you log in as root on the console, xscreensaver will refuse to lock the screen (because it can't tell the difference between root being logged in on the console, and a normal user being logged in on the console but xscreensaver having been launched by the xdm "Xsetup" file.)

The solution to this is simple: you shouldn't be logging in on the console as root in the first place! (What, are you crazy or something?)

Proper Unix hygiene dictates that you should log in as yourself, and su to root as necessary. People who spend their day logged in as root are just begging for disaster.

If you use KDE then you should run KDE Control Center->Appearance & Themes->Screensaver. There you can enable the screensaver to start automatically (e.g. 15 minutes). Also you can set a password that is required to deactivate it. You should use only blank screen. Some screensavers really use massive ressources (although at a low priority).

[1] http://www.jwz.org/xscreensaver/faq.html#root-lock

Joe_Wulf · 06-19-2007, 07:24 PM

Brian,

You asked good questions and gave good insights and gave good advice. Thank you.
1. I'm using RHEL AS4 (any/all updates) and both 32 and 64 bit.
2. Gnome is the default and standard desktop GUI used here, when they initiate a GUI. The system norm is to be at runlevel 3 with 'xfs' stopped. And sudo is enabled/configured for these folks.

I'm building a general secure baseline for others to use. Generally they'll have to live with the hardening I put in place, though they can modify anything based upon need and secondary approval, supported by justification.

I heartily agree that to never (or as close as possible) log in as root is the ideal. As a practical matter, I know for a fact that there are many SysAdmins who'll LIVE at the root prompt regardless of the security measures put in place. Especially for those who'll take my baseline and play with it for days, or weeks to establish the newest version of their application, or whatever.

One of the things I've done through pam is disable all local and remote root login's, both for the text console and within the Gnome GUI. However, once a SysAdmin has logged in with their userID and switched to root, then can start 'xfs' and execute 'startx'. I'm quite aware of this as a prolific 'norm'. Yes, I know it is bad. I do not have any power to influence anyone who uses my build, other than to make it difficult to 'get' there.

Along the way I have folks to answer to as far as how secure my baseline build is. One of the things among many I know they are looking at is the screensaver for all accounts. Thus my rationalle for seeking some technical solution to lock the console via the screensaver.