Disable GDM Automatic Login

An XCCDF Rule

Description

The GNOME Display Manager (GDM) can allow users to automatically login without user interaction or credentials. User should always be required to authenticate themselves to the system that they are authorized to use. To disable user ability to automatically login to the system, set the AutomaticLoginEnable to false in the [daemon] section in /etc/gdm/custom.conf. For example:

[daemon]
AutomaticLoginEnable=false

Rationale

Failure to restrict system access to authenticated users negatively impacts operating system security.

ID: xccdf_org.ssgproject.content_rule_gnome_gdm_disable_automatic_login
Severity: High
References: 11 3 9

BAI10.01 BAI10.02 BAI10.03 BAI10.05

3.1.1

CCI-000366

4.3.4.3.2 4.3.4.3.3

SR 7.6

A.12.1.2 A.12.5.1 A.12.6.2 A.14.2.2 A.14.2.3 A.14.2.4

AC-6(1) CM-6(a) CM-7(b)

PR.IP-1

FIA_UAU.1

SRG-OS-000480-GPOS-00229

CCE-89663-9

8.3.1

RHEL-09-271040

SV-258018r926041_rule
Updated: about 1 year ago

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-89663-9
  - DISA-STIG-RHEL-09-271040  - NIST-800-171-3.1.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-8.3.1
  - gnome_gdm_disable_automatic_login
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy

- name: Disable GDM Automatic Login
  ini_file:
    dest: /etc/gdm/custom.conf
    section: daemon
    option: AutomaticLoginEnable
    value: 'false'
    no_extra_spaces: true
    create: true
  when:
  - '"gdm" in ansible_facts.packages'
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - CCE-89663-9
  - DISA-STIG-RHEL-09-271040
  - NIST-800-171-3.1.1
  - NIST-800-53-AC-6(1)
  - NIST-800-53-CM-6(a)
  - NIST-800-53-CM-7(b)
  - PCI-DSSv4-8.3.1
  - gnome_gdm_disable_automatic_login
  - high_severity
  - low_complexity
  - medium_disruption
  - no_reboot_needed
  - unknown_strategy

# Remediation is applicable only in certain platforms
if rpm --quiet -q gdm && { [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; }; then

if rpm --quiet -q gdm
then
	if ! grep -q "^AutomaticLoginEnable=" /etc/gdm/custom.conf	then
		sed -i "/^\[daemon\]/a \
		AutomaticLoginEnable=False" /etc/gdm/custom.conf
	else
		sed -i "s/^AutomaticLoginEnable=.*/AutomaticLoginEnable=False/g" /etc/gdm/custom.conf
	fi
fi

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Disable GDM Automatic Login

Description

Rationale

Remediation - Ansible

Remediation - Shell Script