Show a warning banner and hide the user list on the GDM login screen

Description

Two settings of the GDM login screen (org.gnome.login-screen):

• banner-message-enable and banner-message-text: show a warning text above the password field;
• disable-user-list: do not list local accounts; users type their login name.

On Debian, the login screen reads a dconf database that GDM rebuilds at each start from /usr/share/gdm/dconf/. That directory links /etc/gdm3/greeter.dconf-defaults, the file where the administrator sets these keys.

The check reads the database the login screen actually uses (DCONF_PROFILE=gdm dconf read, with a temporary home so that the GDM account's own user database is ignored and no file is created in its home), so it only passes after GDM rebuilt it; the fix runs /usr/share/gdm/generate-config, which GDM also runs at each start. The check requires a non-empty banner, not a specific text. /etc/gdm3/greeter.dconf-defaults is a configuration file managed by ucf: package upgrades merge local changes. The fix runs on every remediation and rewrites the three keys.

Rationale

A list of accounts gives an attacker with physical or remote display access half of the credentials. A warning banner states that access is restricted and monitored, which supports legal action against intruders in many jurisdictions.

Impact

Users type their login name instead of clicking it. The banner appears on every login.

Applies when

Detected: when: GNOME Display Manager is installed A scanner reports the control not applicable when one is false.

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

Run as root:

DCONF_PROFILE=gdm dconf read /org/gnome/login-screen/banner-message-enable
DCONF_PROFILE=gdm dconf read /org/gnome/login-screen/banner-message-text
DCONF_PROFILE=gdm dconf read /org/gnome/login-screen/disable-user-list

The first and last must print true, the second a non-empty warning text.

Automated: every check must pass. Scanners report each check by its id.

banner

The login screen shows a non-empty warning banner.

script: |
  # Temporary HOME: dconf must not create root-owned cache files in GDM's home.
  d=$(mktemp -d) || exit 3
  r() { env -u XDG_CONFIG_HOME HOME="$d" XDG_RUNTIME_DIR="$d" DCONF_PROFILE=gdm dconf read "/org/gnome/login-screen/$1" 2>/dev/null; }
  e=$(r banner-message-enable)
  t=$(r banner-message-text)
  rm -rf "$d"
  echo "banner-message-enable=${e:-unset} banner-message-text=${t:-unset}"
  [ "$e" = true ] && [ -n "$t" ] && [ "$t" != "''" ]

user-list

The login screen does not list local accounts.

script: |
  d=$(mktemp -d) || exit 3
  v=$(env -u XDG_CONFIG_HOME HOME="$d" XDG_RUNTIME_DIR="$d" DCONF_PROFILE=gdm dconf read /org/gnome/login-screen/disable-user-list 2>/dev/null)
  rm -rf "$d"
  echo "disable-user-list=${v:-unset}"
  [ "$v" = true ]

Remediation

1. In /etc/gdm3/greeter.dconf-defaults, under the [org/gnome/login-screen] section, set:

   banner-message-enable=true
   banner-message-text='{{ banner_text }}'
   disable-user-list=true
   

2. Run /usr/share/gdm/generate-config (or restart GDM) to rebuild the login screen database.

Rollback

Remove the three lines from /etc/gdm3/greeter.dconf-defaults and run /usr/share/gdm/generate-config.

greeter-defaults

# Debian builds the GDM greeter dconf database from /usr/share/gdm/dconf/, which links
# /etc/gdm3/greeter.dconf-defaults. Set the keys there, then rebuild the database.
f=/etc/gdm3/greeter.dconf-defaults
[ -f "$f" ] || { echo "$f not found" >&2; exit 1; }

# ini_set KEY VALUE: set KEY=VALUE right after the [org/gnome/login-screen] header,
# adding the section if missing.
ini_set() {
  S='[org/gnome/login-screen]' K=$1 V=$2 awk '
    BEGIN { s = ENVIRON["S"]; k = ENVIRON["K"]; v = ENVIRON["V"] }
    function out() { if (!done) { print k "=" v; done = 1 } }
    /^[ \t]*\[/ { print; h = $0; gsub(/^[ \t]+|[ \t]+$/, "", h); in_s = (h == s); if (in_s) out(); next }
    in_s && $0 ~ "^[ \t]*" k "[ \t]*=" { next }
    { print }
    END { if (!done) { print s; out() } }
  ' "$f" >"$f.cirsec-tmp" && cat "$f.cirsec-tmp" >"$f"
  rc=$?
  rm -f "$f.cirsec-tmp"
  return "$rc"
}

# GVariant string: escape backslashes and quotes, newlines as \n.
txt=$(printf '%s\n' "$CB_BANNER_TEXT" | sed -e 's/\\/\\\\/g' -e "s/'/\\\\'/g" | awk 'NR > 1 { printf "\\n" } { printf "%s", $0 }')

cb_backup "$f"
ini_set banner-message-enable true || exit 1
ini_set banner-message-text "'$txt'" || exit 1
ini_set disable-user-list true || exit 1
/usr/share/gdm/generate-config

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• GNOME System Administration Guide - Display a text banner on the login screen The GNOME Project, vendor-doc, accessed 2026-10-18
• GNOME System Administration Guide - Disable the user list The GNOME Project, vendor-doc, accessed 2026-10-18
• Debian Wiki - GDM Debian, vendor-doc, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-AUTH-001 Show a legal warning before login, without system details

People and lifecycle