Skip to content

0081-gdm-config-GDM Not Removed or Login Not Configured

Rule ID

  • 0081-gdm-config

Category

  • system

Level

  • warn

Compatible Versions

  • Linux

Description

  • GDM is the GNOME Display Manager, which handles graphical login on GNOME-based systems.

Scan Frequency

  • 1 */5 * * *

Rationale

  • If graphical login is not required, it should be removed to reduce the system's attack surface. If graphical login is required, the display of the last logged-in user should be disabled and a warning banner should be configured.
    Displaying the last logged-in user removes half of the equation that an unauthorized user would need to guess the user ID/password pair to log in.
    The warning message notifies users attempting to log in to the system about its legal status, and must include the name of the organization that owns the system and any monitoring policies that have been implemented.
    Note:
    Other options and sections may appear in the /etc/dconf/db/gdm.d/01-banner-message file.
    If another GUI login service is being used and is required on the system, refer to its documentation to disable the display of the last logged-in user and apply an equivalent banner.

Risk Item

  • Network Security

Audit Method

  • Run the following command to verify that GDM is not installed on the system:
# rpm -q gdm
package gdm is not installed

Or, if GDM is required:
Verify that /etc/dconf/profile/gdm exists and contains the following:

user-db:user
system-db:gdm file-db:/usr/share/gdm/greeter-dconf-defaults

Verify that a file exists in /etc/dconf/db/gdm.d/ and contains the following (this is typically /etc/dconf/db/gdm.d/01-banner-message):

[org/gnome/login-screen]
banner-message-enable=true
banner-message-text='<banner message>'

Verify that a file exists in /etc/dconf/db/gdm.d/ and contains the following (this is typically /etc/dconf/db/gdm.d/00-login-screen):

[org/gnome/login-screen]
disable-user-list=true

Remediation

  • Run the following command to remove GDM:
# yum remove gdm

Or, if GDM is required:
Edit or create the file /etc/dconf/profile/gdm and add the following:

user-db:user
system-db:gdm
file-db:/usr/share/gdm/greeter-dconf-defaults

Edit or create a file in /etc/dconf/db/gdm.d/ and add the following (this is typically /etc/dconf/db/gdm.d/01-banner-message):

[org/gnome/login-screen]
banner-message-enable=true
banner-message-text='<banner message>'

Example banner text: "Authorized Use Only."
Edit or create a file in /etc/dconf/db/gdm.d/ and add the following (this is typically /etc/dconf/db/gdm.d/00-login-screen):

[org/gnome/login-screen]
# Do not show the user list
disable-user-list=true

Run the following command to update the system database:

# dconf update

Impact

  • None

Default Value

  • (None provided)

References

  • None

CIS Controls

  • Version 7
    5.1 Establish Secure Configurations
    Maintain documented, standard security configuration standards for all authorized operating systems and software.

Feedback

Is this page helpful?