Install the screen Package
Ensures the screen package (terminal multiplexer with session-lock support) is installed.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
A session time-out lock is a temporary measure taken when a user steps away from a terminal without logging out. Rather than relying on the user to lock the session manually, the system should be able to detect an idle session and lock it. The screen package provides a terminal multiplexer that supports an automatic session lock, satisfying the requirement for an idle session-lock capability (NIST 3.1.10).
What Pavois checks
Pavois queries the RPM database with describe package('screen') and asserts it should be_installed, reading the actual installed state rather than guessing from a binary path.
describe package('screen') do
it { should be_installed }
endHow to verify it is applied
Run rpm -q screen. Expected output: a versioned package name such as screen-4.x-…. You can also check command -v screen returns /usr/bin/screen.
Inspect & investigate
Installation is recorded by DNF/RPM: review dnf history or /var/log/dnf.rpm.log (filter with grep screen). Confirm presence with rpm -q screen.
Remediation
Pavois's harden plan installs the screen package (resource package, action install). Apply it with pavois harden apply. Note that installing screen provides the capability; admins still configure the lock (e.g. lockscreen / a password in ~/.screenrc).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | screen |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing screen is low-risk: it adds a userland tool and changes no running service. It pulls in a small dependency set. By itself the package does not enforce a lock, operators must configure the session-lock behaviour to fully meet the control. Some sites prefer tmux instead; if a session-lock multiplexer is already in place, this requirement may be satisfied differently.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| NIST | 3.1.10 | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.