# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEB-DESK-007
title: Refuse root logins at the graphical login screen
finding:
  title: root can open a graphical session
  description: A full desktop session as root runs a browser, a mail client and many other programs with every privilege, and leaves no trace of which administrator used it.
status: active
profiles: [desktop]
risk:
  severity: medium
assessment: automated
tags: [gdm, lightdm, sddm, pam, root]

description: |
  Display managers authenticate users through PAM services in `/etc/pam.d/`. A line
  `auth required pam_succeed_if.so user != root quiet_success` at the top of the auth stack
  refuses root before the password is checked. Debian's GDM and SDDM packages ship that line;
  LightDM's `lightdm` service does not. The control checks the password, fingerprint and smart
  card services of GDM, and the login services of LightDM and SDDM, that are present.
rationale: |
  A graphical session runs hundreds of processes and parses untrusted content (web pages, mail,
  documents). Running all of it as root turns any bug into a full compromise. Administrators
  should log in with their own account and elevate with sudo, which keeps their actions
  attributable.
impact: |
  root cannot log in graphically. Administrators use their own account and sudo.
notes: |
  Automatic login services (`gdm-autologin`, `lightdm-autologin`, `sddm-autologin`) are not
  checked: CB-DEB-DESK-006 forbids automatic login. The fix only adds the line to services
  that lack it and was tested by removing the line from `gdm-password`; it was not tested with
  LightDM or SDDM. It changes PAM, so it is disabled by default.

setting:
  location: /etc/pam.d/gdm-password, gdm-fingerprint, gdm-smartcard, lightdm, sddm
  default_value: Present for GDM and SDDM, missing for LightDM
  recommended_value: auth required pam_succeed_if.so user != root quiet_success

audit:
  manual: |
    For each of `/etc/pam.d/gdm-password`, `gdm-fingerprint`, `gdm-smartcard`, `lightdm` and
    `sddm` that exists, check that the auth stack contains a `pam_succeed_if.so` line with
    `user != root` and a `required` or `requisite` control (or `default=bad`).
  checks:
    - id: pam-root
      engine: shell
      description: Display manager PAM services refuse root.
      spec:
        script: |
          re='^[[:space:]]*auth[[:space:]]+(required|requisite|\[[^]]*default=(bad|die)[^]]*\])[[:space:]]+pam_succeed_if\.so[[:space:]].*user[[:space:]]*!=[[:space:]]*root'
          found=0 rc=0
          for f in /etc/pam.d/gdm-password /etc/pam.d/gdm-fingerprint /etc/pam.d/gdm-smartcard \
            /etc/pam.d/lightdm /etc/pam.d/sddm; do
            [ -f "$f" ] || continue
            found=1
            if grep -Eq "$re" "$f"; then echo "$f refuses root"; else echo "$f allows root"; rc=1; fi
          done
          [ "$found" = 1 ] || { echo "no display manager PAM service"; exit 2; }
          exit "$rc"

remediation:
  manual: |
    In each display manager PAM service listed by the audit that lacks it, add before the first
    `auth` line:
    ```
    auth required pam_succeed_if.so user != root quiet_success
    ```
  effects:
    restart: none
    disruption: low
    lockout_risk: true
  rollback: |
    Restore the changed files of `/etc/pam.d/` from the backup directory.
  scripts:
    - id: pam-root
      engine: shell
      file: fix.sh

references:
  - title: pam_succeed_if(8), Debian manual pages
    url: https://manpages.debian.org/trixie/libpam-runtime/pam_succeed_if.8.en.html
    publisher: Debian
    kind: vendor-doc
    accessed: 2026-10-18
  - title: ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R33)
    url: https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf
    publisher: ANSSI
    kind: guide
    accessed: 2026-10-18
mappings:
  - framework: anssi-linux
    framework_version: "2.0"
    id: R33
    relation: related
    note: R33 asks for attributable administration; refusing graphical root sessions is one part of it.
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AC-6(2)
    relation: related
threats:
  - framework: mitre-attack
    id: T1078.003
related_controls:
  - id: CB-DEB-DESK-006
    type: related

authors:
  - name: Alice
    github: Sn0wAlice
verified:
  - date: 2026-10-18
    by: Sn0wAlice
    versions: ["12"]
    environment: Proxmox VM with minimal GNOME (gdm3, gnome-shell), Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64
    notes: "Check and fix tested on GDM after removing the root line from gdm-password; pamtester confirmed root refused and a normal account still authenticated after the fix. LightDM and SDDM services not tested."
  - date: 2026-10-18
    by: Sn0wAlice
    versions: ["13"]
    environment: Proxmox VM with minimal GNOME (gdm3, gnome-shell), Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64
    notes: "Check and fix tested on GDM after removing the root line from gdm-password; pamtester confirmed root refused and a normal account still authenticated after the fix. LightDM and SDDM services not tested."
introduced_in: 0.1.0
created: 2026-10-18
updated: 2026-10-18