Title: Automatically lock screen on OpenBSD using xidle and xlock

	Title: Automatically lock screen on OpenBSD using xidle and xlock
	Author: Solène
	Date: 30 July 2021
	Tags: openbsd security
	Description:

	# Introduction

	For security reasons I like when my computer screen get locked when I'm
	away and forgot to lock it manually or when I suspend the computer.
	Those operations are usually native in desktop managers such as Xfce,
	MATE or Gnome but not when you use a simple window manager.

	Yesterday, I was looking at the xlock man page and found
	recommendations to use it with xidle, a program that triggers a command
	when we don't use a computer. That was the match I required to do
	something.

	# xidle

	xidle is simple, you tell it about conditions and it will run a
	command. Basically, it has three triggers:

	* no activity from the user after $TIMEOUT
	* cursor is moved in a screen border or corner for $SECONDS
	* xidle receives a SIGUSR1 signal

	The first trigger is useful for automatic run, usually when you leave
	the computer and you forget to lock. The second one is a simple way to
	trigger your command manually by moving the cursor at the right place,
	and finally the last one is the way to script the trigger.

	xidle man page, EXAMPLES section showing how to use it with xlock
	xlock man page

	# Using both

	Reusing the example given in xidle it was easy to build the command
	line. You would have to use this in your ~/.xsession file that contain
	instructions to run your graphical session. The following command will
	lock the screen if you let your mouse cursor in the upper left corner
	of the screen for 5 seconds or if you are inactive for 1800 seconds (30
	minutes), once the screen is locked by xlock, it will turn off the
	display after 5 seconds. It is critical to run this command in
	background using "&" so the xsession script can continue.

	```shell commands
	xidle -delay 5 -nw -program "/usr/X11R6/bin/xlock -dpmsstandby 5" -timeout 1800…
	```

	# Resume / Suspend case

	So, we currently made your computer auto locking after some time when
	you are not using it, but what if you put your computer on suspend and
	leave, this mean anyone can open it and it won't be locked. We should
	trigger the command just before suspending the device, so it will be
	locked upon resume.

	This operation is possible by giving a SIGUSR1 to xidle at the right
	time, and apmd (the power management daemon on OpenBSD) is able to
	execute scripts when suspending (and not only).

	apmd man page, FILES section about the supported operations running scripts

	Create the directory /etc/apm/ and write /etc/apm/suspend with this
	content:

	```shell script
	#!/bin/sh

	pkill -USR1 xidle
	```

	Make the script executable with chmod +x /etc/apm/suspend and restart
	apmd. Now, you should have the screen getting locked when you suspend
	your computer, automatically.

	# Conclusion

	Locking access to a computer is very important because most of the time
	we have programs opened, security keys unlocked (ssh, gpg, password
	managers etc...) and if someone put their hands on it they can access
	all files. Locking the screen is a simple but very effective way to
	prevent this disaster to happen.