Skip to content
Log In

Disable GDM Unattended or Automatic Login

An XCCDF Rule

Description

The GNOME Display Manager (GDM) can allow users to automatically login without user interaction or credentials or unattended login. User should always be required to authenticate themselves to the system that they are authorized to use. To disable user ability to automatically login to the system, set the DISPLAYMANAGER_AUTOLOGIN="" or DISPLAYMANAGER_PASSWORD_LESS_LOGIN="no" in the /etc/sysconfig/displaymanager. For example: 
DISPLAYMANAGER_AUTOLOGIN=""
DISPLAYMANAGER_PASSWORD_LESS_LOGIN="no"

Rationale

Failure to restrict system access to authenticated users negatively impacts operating system security.

ID
xccdf_org.ssgproject.content_rule_gnome_gdm_disable_unattended_automatic_login
Severity
High
References
Updated

Remediation Templates

A Shell Script

# Remediation is applicable only in certain platforms
if rpm --quiet -q gdm && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then
if ! (sed -n '/^DISPLAYMANAGER_AUTOLOGIN=\"\"/p' /etc/sysconfig/displaymanager)
then
  sed -i "s/^DISPLAYMANAGER_AUTOLOGIN=.*/DISPLAYMANAGER_AUTOLOGIN=\"\"/g" /etc/sysconfig/displaymanager
fi

An Ansible Snippet

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-83245-1
  - DISA-STIG-SLES-12-010380