documentation_complete: true

prodtype: rhel7,fedora

title: 'Require Credential Prompting for Remote Access in GNOME3'

description: |-
    By default, <tt>GNOME</tt> does not require credentials when using <tt>Vino</tt> for
    remote access. To configure the system to require remote credentials, add or set
    <tt>authentication-methods</tt> to <tt>['vnc']</tt> in
    <tt>/etc/dconf/db/local.d/00-security-settings</tt>. For example:
    <pre>[org/gnome/Vino]
    authentication-methods=['vnc']
    </pre>
    Once the settings have been added, add a lock to
    <tt>/etc/dconf/db/local.d/locks/00-security-settings-lock</tt> to prevent user modification.
    For example:
    <pre>/org/gnome/Vino/authentication-methods</pre>
    After the settings have been set, run <tt>dconf update</tt>.

rationale: |-
    Username and password prompting is required for remote access. Otherwise, non-authorized
    and nefarious users can access the system freely.

severity: medium

identifiers:
    cce@rhel7: 80120-9

references:
    cui: 3.1.12
    hipaa: 164.308(a)(4)(i),164.308(b)(1),164.308(b)(3),164.310(b),164.312(e)(1),164.312(e)(2)(ii)

ocil_clause: 'wireless network notification is enabled and not disabled'

ocil: |-
    To ensure that remote access requires credentials, run the following command:
    <pre>$ gsettings get org.gnome.Vino authentication-methods</pre>
    If properly configured, the output should be <tt>false</tt>.
    To ensure that users cannot disable credentials for remote access, run the following:
    <pre>$ grep authentication-methods /etc/dconf/db/local.d/locks/*</pre>
    If properly configured, the output should be
    <tt>/org/gnome/Vino/authentication-methods</tt>
