gdm Create User
mattdm at mattdm.org
Sun Oct 7 12:06:22 UTC 2007
On Sun, Oct 07, 2007 at 07:42:23AM -0400, Steve Grubb wrote:
> > > Whenever gdm receives an unknown username, *automatically* create
> > > that account as new, and log them in.
> > If you consider that GDM can be reached via a network using XDMCP, that
> > means that you may expos an automated way to discover valid usernames on
> > a box.
> I completely agree here. From a security perspective, this is a bad idea.
GDM knows if it's running locally or via xdmcp, though. It could act
> There is also an audit trail that has certain requirements, too. We need to
> know the real user ID that is creating the account. (Its not root.) Root is a
> shared account and we need the loginuid of the person creating the account.
> So, they really do need to log in so that a proper session is setup and all
> the things we need for the audit trail is filled in.
And yes, the feature should certainly be easy to deactivate. It's
inappropriate for a wide variety of situations.
Matthew Miller mattdm at mattdm.org <http://mattdm.org/>
Boston University Linux ------> <http://linux.bu.edu/>
More information about the fedora-devel-list