An X Windows display manager must not be installed unless approved.

From Canonical Ubuntu 16.04 Security Technical Implementation Guide

Associated with: CCI-000366

SV-90581r1_rule An X Windows display manager must not be installed unless approved.

Vulnerability discussion

Internet services that are not required for system or application processes must not be active to decrease the attack surface of the system. X Windows has a long history of security vulnerabilities and will not be used unless approved and documented.

Check content

Verify that if X Windows is installed it is authorized. Check for the X11 package with the following command: # dpkg -l | grep lightdm Ask the System Administrator if use of the X Windows system is an operational requirement. If the use of X Windows on the system is not documented with the Information System Security Officer (ISSO), this is a finding.

Fix text

Document the requirement for an X Windows server with the Information System Security Officer (ISSO) or remove the related packages with the following commands: # sudo apt-get purge lightdm

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.