Lock idle sessions outside GNOME, through logind and the KDE screen locker

Description

Two settings lock idle sessions independently of GNOME (covered by CB-DEB-DESK-003):

• systemd-logind: IdleAction=lock with IdleActionSec asks every session to lock once the system has been idle that long. Desktops that report idleness to logind (GNOME, KDE Plasma) honor it;
• KDE Plasma: the screen locker reads Autolock, Timeout (minutes) and Lock from the [Daemon] group of kscreenlockerrc. The system file /etc/xdg/kscreenlockerrc sets them and marks the group immutable with [Daemon][$i], so user files cannot override them.

Xfce has no setting a script can lock reliably: configure xfce4-screensaver (lock enabled, delay at most {{ idle_minutes }} minutes) or light-locker and check it by hand. The logind setting applies at the next boot (systemd 252 in Debian 12 cannot reload logind). The KDE check was written from the KDE documentation and not tested in a lab; it has no automated fix.

Rationale

An unattended unlocked session gives its access to anyone passing by. The logind idle action is a safety net that does not depend on each desktop's own settings, and the KDE lock keeps users from extending or disabling the delay.

Impact

Sessions lock after {{ idle_minutes }} minutes without input. Users of KDE Plasma cannot change the lock settings.

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. systemd-analyze cat-config systemd/logind.conf must end up with IdleAction=lock and IdleActionSec at most {{ idle_minutes }} minutes.
2. With KDE Plasma, /etc/xdg/kscreenlockerrc must contain a [Daemon][$i] group with Autolock and Lock not set to false and Timeout at most {{ idle_minutes }}.
3. With Xfce, check the screen saver settings of each user.

Automated: every check must pass. Scanners report each check by its id.

logind

logind locks sessions after the idle delay.

script: |
  conf=$(systemd-analyze cat-config systemd/logind.conf 2>/dev/null) || exit 3
  a=$(printf '%s\n' "$conf" | sed -n 's/^[[:space:]]*IdleAction[[:space:]]*=[[:space:]]*//p' | tail -n 1)
  s=$(printf '%s\n' "$conf" | sed -n 's/^[[:space:]]*IdleActionSec[[:space:]]*=[[:space:]]*//p' | tail -n 1)
  us=$(systemd-analyze timespan "${s:-30min}" 2>/dev/null | awk '/s:/ { print $2; exit }')
  echo "IdleAction=${a:-ignore} IdleActionSec=${s:-30min (default)}"
  [ "$a" = lock ] || exit 1
  [ -n "$us" ] || exit 3
  [ "$us" -gt 0 ] && [ "$us" -le $((CB_IDLE_MINUTES * 60000000)) ]

kde

The KDE screen locker settings are locked and lock within the delay.

script: |
  f=/etc/xdg/kscreenlockerrc
  [ -f "$f" ] || { echo "$f missing"; exit 1; }
  o=$(awk '/^[ \t]*\[/ { s = ($0 ~ /^[ \t]*\[Daemon\]\[\$i\][ \t]*$/); if (s) imm = 1; next }
    s && /=/ { k = $0; sub(/[ \t]*=.*/, "", k); v = $0; sub(/^[^=]*=[ \t]*/, "", v); val[k] = v }
    END { printf "immutable=%d Autolock=%s Lock=%s Timeout=%s\n", imm, val["Autolock"], val["Lock"], val["Timeout"] }' "$f")
  echo "$o"
  case $o in *immutable=1*) ;; *) exit 1 ;; esac
  case $o in *Autolock=false* | *Lock=false*) exit 1 ;; esac
  t=$(printf '%s' "$o" | sed -n 's/.*Timeout=\([0-9]*\).*/\1/p')
  [ "${t:-5}" -ge 1 ] && [ "${t:-5}" -le "$CB_IDLE_MINUTES" ]

Remediation

1. Create /etc/systemd/logind.conf.d/60-cirsec.conf:

   [Login]
   IdleAction=lock
   IdleActionSec={{ idle_minutes }}min
   

   It applies at the next boot.
2. With KDE Plasma, create /etc/xdg/kscreenlockerrc:

   [Daemon][$i]
   Autolock=true
   Lock=true
   LockOnResume=true
   Timeout={{ idle_minutes }}
   

3. With Xfce, enable locking in the screen saver settings of each user.

Rollback

Delete /etc/systemd/logind.conf.d/60-cirsec.conf and /etc/xdg/kscreenlockerrc.

logind

f=/etc/systemd/logind.conf.d/60-cirsec.conf
cb_backup "$f"
mkdir -p /etc/systemd/logind.conf.d
printf '%s\n' '# Written by CIRSEC Baselines CB-DEB-DESK-008' '[Login]' 'IdleAction=lock' \
  "IdleActionSec=${CB_IDLE_MINUTES}min" >"$f"

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• logind.conf(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• KDE Developer - Kiosk, introduction (immutable settings) KDE, vendor-doc, accessed 2026-10-18
• kscreenlocker - kscreenlockerrc settings (kscreenlockersettings.kcfg) KDE, vendor-doc, accessed 2026-10-18
• Xfce documentation - xfce4-screensaver Xfce, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R32) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-DESK-003 Lock GNOME sessions after a short inactivity delay
• related CB-DEB-DESK-009 Lock the session when the screen saver starts and when the system suspends

People and lifecycle