Information
GDM is the GNOME Display Manager which handles graphical login for GNOME based systems.
The disable-user-list option controls if a list of users is displayed on the login screen
Displaying the user list eliminates half of the Userid/Password equation that an unauthorized person would need to log on.
Solution
- IF - A user profile exists run the following command to enable the disable-user-list :
# gsettings set org.gnome.login-screen disable-user-list true
Note:
- gsettings commands in this section MUST be done from a command window on a graphical desktop or an error will be returned.
- The system must be restarted after all gsettings configurations have been set in order for CIS-CAT Assessor to appropriately assess.
- If the dconf database is not updating correctly due to umask requirements contain in the benchmark, then use (umask 0022 && gsetting set) commands from above to temporarily set umask ensuring that any files or directories created by gsettings will have the required permissions.
- OR/IF - A user profile does not exist:
- Create or edit the gdm profile in /etc/dconf/profile/gdm with the following lines:
user-db:user
system-db:gdm
file-db:/usr/share/gdm/greeter-dconf-defaults
Note: gdm is the name of a dconf database.
<xhtml:ol start="2"> - Create a gdm keyfile for machine-wide settings in /etc/dconf/db/gdm.d/00-login-screen :
[org/gnome/login-screen]
# Do not show the user list
disable-user-list=true <xhtml:ol start="3"> - Update the system databases:
# dconf update
Note: When the user profile is created or changed, the user will need to log out and log in again before the changes will be applied.