OL07-00-010063 - The Oracle Linux operating system must disable the login screen user list for graphical user interfaces.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Leaving the user list enabled is a security risk as it allows anyone with physical access to the system to enumerate known user accounts without authenticated access to the system.

Solution

Configure the operating system to disable the login screen user list for graphical user interfaces.

Create or edit the gdm profile in '/etc/dconf/profile/' to contain the following lines:

$ sudo vi /etc/dconf/profile/gdm

user-db:user
system-db:gdm
file-db:/usr/share/gdm/greeter-dconf-defaults

Create or edit the gdm database for machine-wide settings in '/etc/dconf/db/gdm.d/' with the following lines:

$ sudo vi /etc/dconf/db/gdm.d/00-login-screen

[org/gnome/login-screen]
disable-user-list=true

Update the system databases by updating the dconf utility:

$ sudo dconf update

If the login screen user list persists after updating the system databases, you can restart the GNOME Desktop without rebooting the system:

$ sudo systemctl restart gdm

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Linux_7_V2R13_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000366, Rule-ID|SV-256976r902765_rule, STIG-ID|OL07-00-010063, Vuln-ID|V-256976

Plugin: Unix

Control ID: d7fd270706581d01ebeadc5e800d1d775f342d06687411d7263cc9e0468e50d9