Detections
Analytics

1.7.3 Ensure GDM disable-user-list option is enabled

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

GDM is the GNOME Display Manager which handles graphical login for GNOME based systems.

The disable-user-list option controls if a list of users is displayed on the login screen

Displaying the user list eliminates half of the Userid/Password equation that an unauthorized person would need to log on.

Solution

- IF - A user profile exists run the following command to enable the disable-user-list :

 # gsettings set org.gnome.login-screen disable-user-list true

 Note:

 - gsettings commands in this section MUST be done from a command window on a graphical desktop or an error will be returned.
 - The system must be restarted after all gsettings configurations have been set in order for CIS-CAT Assessor to appropriately assess.
 - If the dconf database is not updating correctly due to umask requirements contain in the benchmark, then use (umask 0022 && gsetting set) commands from above to temporarily set umask ensuring that any files or directories created by gsettings will have the required permissions.

 - OR/IF - A user profile does not exist:

 - Create or edit the gdm profile in /etc/dconf/profile/gdm with the following lines:
user-db:user
 system-db:gdm
 file-db:/usr/share/gdm/greeter-dconf-defaults

 Note: gdm is the name of a dconf database.

 - Create a gdm keyfile for machine-wide settings in /etc/dconf/db/gdm.d/00-login-screen :
[org/gnome/login-screen]
 # Do not show the user list
 disable-user-list=true
 - Update the system databases:
# dconf update

 Note: When the user profile is created or changed, the user will need to log out and log in again before the changes will be applied.

See Also

https://workbench.cisecurity.org/benchmarks/18960

Item Details

Plugin: Unix

Control ID: a04c444c97a33fc72117b99cd5933a2617767231402690f698dd4e17623c5029