In the previous part

Configuring Command Line Warning Banners

was completed.

1. CIS Benchmark Requirements (Section 1.8)

This section of the CIS standard reviews the graphical user interface (GUI) environment and the GNOME login manager service, known as GDM:

• 1.8.1 Ensure GNOME Display Manager is removed (Automated)
• 1.8.2 Ensure GDM login banner is configured (Automated)
• 1.8.3 Ensure GDM disable-user-list option is enabled (Automated)
• 1.8.4 Ensure GDM screen locks when the user is idle (Automated)
• 1.8.5 Ensure GDM screen locks cannot be overridden (Automated)
• 1.8.6 Ensure GDM automatic mounting of removable media is disabled (Automated)
• 1.8.7 Ensure GDM disabling automatic mounting of removable media is not overridden (Automated)
• 1.8.8 Ensure GDM autorun-never is enabled (Automated)
• 1.8.9 Ensure GDM autorun-never is not overridden (Automated)
• 1.8.10 Ensure XDMCP is not enabled (Automated)

2. Concept & Rationale

Concept: Graphical user interface (GUI) environments such as GNOME and its login manager service (GDM) are tools that make desktop work easier for users.

Security Reason: Installing a graphical environment on servers significantly increases the attack surface, consumes valuable system resources such as RAM and CPU, and requires the installation and maintenance of hundreds of additional dependency packages.

Standard Approach: The CIS standard explicitly recommends in section 1.8.1 that GDM be removed from the server. If GDM is removed, requirements 1.8.2 through 1.8.10 are automatically satisfied, because the problem is removed at its source.

3. Oracle Database Compatibility Check (RAC, ASM, Grid)

Removing the graphical environment and GDM is a highly recommended action in Oracle environments.

• No GUI Requirement: Oracle database servers, including Database, Grid Infrastructure, and ASM, do not need a graphical environment. All database installation, grid installation, and patching operations performed by OUI and OPatch can and should be done in Silent Mode using Response Files.
• Improved Performance and Security: Removing the GUI not only maximizes server security and neutralizes the risks caused by additional packages, but also dedicates all processing resources of the server exclusively to critical Oracle processes, with no interference to the cluster or database operation.

4. Checking the Current Status (Audit Script)

To check whether the GDM package is installed and to verify the operating system default boot target, the following commands are used:

GitHub link:

modules/audit_09_Configure_GDM.sh

If you are not familiar with bash scripts, you can refer to the training material I have published on the site for database administrators.

Bash for Oracle DBAs

#!/bin/bash
# Script: audit9.sh
# Purpose: Audit GNOME Display Manager (GDM) and Boot Target (CIS 1.8)

echo "==========================================================================" echo " CIS Requirement: 1.8 GNOME Display Manager" echo " - Ensure GDM is removed or disabled." echo " - Ensure default boot target is multi-user.target." echo " Oracle Context:" echo " - Highly Recommended. GUI is not needed for Oracle DB/RAC." echo " - Removing GDM saves resources and reduces attack surface." echo "=========================================================================="

FAIL_COUNT=0

echo -e "\n[*] Auditing GDM Package and Boot Target..."

# 1. Check if GDM is installed if rpm -q gdm > /dev/null 2>&1; then echo -e " \e[31m[FAIL]\e[0m GDM package is installed." FAIL_COUNT=$((FAIL_COUNT + 1)) else echo -e " \e[32m[PASS]\e[0m GDM package is not installed." fi

# 2. Check default boot target CURRENT_TARGET=$(systemctl get-default) if [ "$CURRENT_TARGET" == "multi-user.target" ]; then echo -e " \e[32m[PASS]\e[0m System default target is $CURRENT_TARGET." else echo -e " \e[31m[FAIL]\e[0m Default target is $CURRENT_TARGET (Expected: multi-user.target)." FAIL_COUNT=$((FAIL_COUNT + 1)) fi

if [ "$FAIL_COUNT" -eq 0 ]; then echo -e "\n\e[32m[+] AUDIT RESULT: PASS\e[0m" else echo -e "\n\e[31m[-] AUDIT RESULT: FAIL ($FAIL_COUNT issues found)\e[0m" fi

5. Applying the Configuration (Remediation Bash Script)

The following script removes the GDM environment if present and ensures that the operating system always boots in text mode (multi-user target):

GitHub link:

modules/remediate_09_Configure_GDM.sh

#!/bin/bash
# Script: remediation9.sh
# Purpose: Remove GDM and Enforce CLI Boot Mode (CIS 1.8)

if [ "$EUID" -ne 0 ]; then echo "Please run as root" exit 1 fi

echo "==========================================================================" echo " Applying Remediation for CIS 1.8 (GNOME Display Manager)" echo " Oracle Context: Safe and Recommended for Database Servers." echo "=========================================================================="

# 1. Remove GDM if installed if rpm -q gdm > /dev/null 2>&1; then echo "[*] Removing GDM package and dependencies..." dnf remove -y gdm echo -e " \e[32m[OK]\e[0m GDM removed successfully." else echo -e " \e[32m[OK]\e[0m GDM is already absent." fi

# 2. Enforce CLI Boot Mode CURRENT_TARGET=$(systemctl get-default) if [ "$CURRENT_TARGET" != "multi-user.target" ]; then echo "[*] Setting default target to multi-user.target..." systemctl set-default multi-user.target echo -e " \e[32m[OK]\e[0m Default target updated to multi-user.target." else echo -e " \e[32m[OK]\e[0m Default target is already multi-user.target." fi

echo -e "\n\e[32m[+] REMEDIATION APPLIED SUCCESSFULLY\e[0m"

In the next part, we will continue with

Disabling and Removing Unnecessary Services

.