.Xauthority or X*.hosts (or equivalent) file(s) must be used to restrict access to the X server.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-12016	GEN005220	SV-37684r1_rule	ECCD-1 ECCD-2	Medium

Description
If access to the X server is not restricted, a user's X session may be compromised.

STIG	Date
Red Hat Enterprise Linux 5 Security Technical Implementation Guide	2016-12-16

Details

Check Text ( C-36875r1_chk )
Determine if the X server is running. Procedure: # ps -ef \|grep X Determine if xauth is being used. Procedure: # xauth xauth> list If the above command sequence does not show any host other than the localhost, then xauth is not being used. Search the system for an X.hosts file, where "" is a display number used to limit X window connections. If no files are found, X.hosts files are not being used. If the X.hosts files contain any unauthorized hosts, this is a finding. If both xauth and X*.hosts files are not being used, this is a finding.

Check Text ( C-36875r1_chk )

Determine if the X server is running.
Procedure:
# ps -ef |grep X

Determine if xauth is being used.
Procedure:
# xauth
xauth> list

If the above command sequence does not show any host other than the localhost, then xauth is not being used.

Search the system for an X*.hosts file, where "*" is a display number used to limit X window connections. If no files are found, X*.hosts files are not being used. If the X*.hosts files contain any unauthorized hosts, this is a finding.

If both xauth and X*.hosts files are not being used, this is a finding.

Fix Text (F-31858r1_fix)
Create an X.hosts file, where "" is a display number used to limit X window connections. Add the list of authorized X clients to the file.