{
  "id": "CB-UBU-DESK-007",
  "standard": "ubuntu",
  "version": "0.1.1",
  "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.1/CB-UBU-DESK-007",
  "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.1/CB-UBU-DESK-007.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.1/CB-UBU-DESK-007.yml",
  "profiles_effective": [
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-DESK-007",
    "title": "Refuse root logins at the graphical login screen",
    "finding": {
      "title": "root can open a graphical session",
      "description": "A full desktop session as root runs a browser, a mail client and many other programs with every privilege, and leaves no trace of which administrator used it."
    },
    "status": "active",
    "profiles": [
      "desktop"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "automated",
    "tags": [
      "gdm",
      "lightdm",
      "sddm",
      "pam",
      "root"
    ],
    "description": "Display managers authenticate users through PAM services in `/etc/pam.d/`. A line\n`auth required pam_succeed_if.so user != root quiet_success` at the top of the auth stack\nrefuses root before the password is checked. Ubuntu's GDM package ships that line in every\nservice; other display managers may not. The control checks the password, fingerprint and\nsmart card services of GDM (`gdm-smartcard` and its `gdm-smartcard-*` variants, selected\nwith update-alternatives since 22.04), and the login services of LightDM and SDDM, that are\npresent.\n",
    "rationale": "A graphical session runs hundreds of processes and parses untrusted content (web pages, mail,\ndocuments). Running all of it as root turns any bug into a full compromise. Administrators\nshould log in with their own account and elevate with sudo, which keeps their actions\nattributable.\n",
    "impact": "root cannot log in graphically. Administrators use their own account and sudo.\n",
    "notes": "Automatic login services (`gdm-autologin`, `lightdm-autologin`, `sddm-autologin`) are not\nchecked: CB-UBU-DESK-006 forbids automatic login. The fix only adds the line to services\nthat lack it and was tested by removing the line from `gdm-password`; it was not tested with\nLightDM or SDDM. It changes PAM, so it is disabled by default.\n",
    "setting": {
      "location": "/etc/pam.d/gdm-password, gdm-fingerprint, gdm-smartcard*, lightdm, sddm",
      "default_value": "Present for GDM",
      "recommended_value": "auth required pam_succeed_if.so user != root quiet_success"
    },
    "audit": {
      "manual": "For each of `/etc/pam.d/gdm-password`, `gdm-fingerprint`, `gdm-smartcard*`, `lightdm` and\n`sddm` that exists, check that the auth stack contains a `pam_succeed_if.so` line with\n`user != root` and a `required` or `requisite` control (or `default=bad`).\n",
      "checks": [
        {
          "id": "pam-root",
          "engine": "shell",
          "description": "Display manager PAM services refuse root.",
          "spec": {
            "script": "re='^[[:space:]]*auth[[:space:]]+(required|requisite|\\[[^]]*default=(bad|die)[^]]*\\])[[:space:]]+pam_succeed_if\\.so[[:space:]].*user[[:space:]]*!=[[:space:]]*root'\nfound=0 rc=0\nfor f in /etc/pam.d/gdm-password /etc/pam.d/gdm-fingerprint /etc/pam.d/gdm-smartcard* \\\n  /etc/pam.d/lightdm /etc/pam.d/sddm; do\n  [ -f \"$f\" ] || continue\n  found=1\n  if grep -Eq \"$re\" \"$f\"; then echo \"$f refuses root\"; else echo \"$f allows root\"; rc=1; fi\ndone\n[ \"$found\" = 1 ] || { echo \"no display manager PAM service\"; exit 2; }\nexit \"$rc\"\n"
          }
        }
      ]
    },
    "remediation": {
      "manual": "In each display manager PAM service listed by the audit that lacks it, add before the first\n`auth` line:\n```\nauth required pam_succeed_if.so user != root quiet_success\n```\n",
      "effects": {
        "restart": "none",
        "disruption": "low",
        "lockout_risk": true
      },
      "rollback": "Restore the changed files of `/etc/pam.d/` from the backup directory.\n",
      "scripts": [
        {
          "id": "pam-root",
          "engine": "shell",
          "file": "fix.sh"
        }
      ]
    },
    "references": [
      {
        "title": "pam_succeed_if(8), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man8/pam_succeed_if.8.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R33)",
        "url": "https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf",
        "publisher": "ANSSI",
        "kind": "guide",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-linux",
        "framework_version": "2.0",
        "id": "R33",
        "relation": "related",
        "note": "R33 asks for attributable administration; refusing graphical root sessions is one part of it."
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-6(2)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.003"
      }
    ],
    "related_controls": [
      {
        "id": "CB-UBU-DESK-006",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM with Ubuntu Desktop (GNOME 3.36, gdm3), Ubuntu 20.04.6, kernel 5.4.0-216-generic",
        "notes": "Check and fix tested after removing the root line from gdm-password; pamtester confirmed root refused and a normal account still authenticated after the fix. LightDM and SDDM services not tested."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM with Ubuntu Desktop (GNOME 42, gdm3), Ubuntu 22.04.5, kernel 5.15.0-198-generic",
        "notes": "Check and fix tested after removing the root line from gdm-password; pamtester confirmed root refused and a normal account still authenticated after the fix. LightDM and SDDM services not tested."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM with Ubuntu Desktop (GNOME 46, gdm3), Ubuntu 24.04.5, kernel 6.8.0-147-generic",
        "notes": "Check and fix tested after removing the root line from gdm-password; pamtester confirmed root refused and a normal account still authenticated after the fix. LightDM and SDDM services not tested."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM with Ubuntu Desktop (GNOME 50, gdm3), Ubuntu 26.04.1, kernel 7.0.0-38-generic",
        "notes": "Check and fix tested after removing the root line from gdm-password; pamtester confirmed root refused and a normal account still authenticated after the fix. LightDM and SDDM services not tested."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}