{ "id": "CB-UBU-DESK-006", "standard": "ubuntu", "version": "0.1.2", "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-DESK-006", "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-DESK-006.json", "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.2/CB-UBU-DESK-006.yml", "profiles_effective": [ "desktop", "desktop-hardened" ], "license": "Text CC BY 4.0, code Apache-2.0", "attribution": "CIRSEC Baselines, https://baselines.cirsec.org", "control": { "id": "CB-UBU-DESK-006", "title": "Require a password at the graphical login, without automatic login or guest session", "finding": { "title": "The display manager opens a session without a password", "description": "Automatic, timed or guest login gives a working session to anyone who turns on or sits at the machine." }, "status": "active", "profiles": [ "desktop" ], "risk": { "severity": "high" }, "assessment": "automated", "tags": [ "gdm", "lightdm", "sddm", "login", "authentication" ], "description": "Display managers can open a session without authentication:\n\n- GDM: `AutomaticLoginEnable` and `TimedLoginEnable` in the `[daemon]` section of\n `/etc/gdm3/custom.conf`;\n- LightDM: `autologin-user`, `autologin-guest` and the guest session (`allow-guest`, on by\n default upstream);\n- SDDM: `User` in the `[Autologin]` section of its configuration.\n\nThis control checks that none of them is enabled and that LightDM explicitly disables the\nguest session.\n", "rationale": "A session opened without a password gives the account's files, browser sessions, stored\ncredentials and network access to whoever is in front of the screen, or to whoever steals\nthe machine. A guest session gives an unaudited foothold on the system.\n", "impact": "Every user types a password at boot. Kiosks that rely on automatic login must be excluded\nthrough tailoring.\n", "notes": "Ubuntu's GDM reads `/etc/gdm3/custom.conf` (not `daemon.conf` as on Debian). The Ubuntu\ninstaller writes `AutomaticLoginEnable=true` there when \"Log in automatically\" is chosen.\nGDM has no guest session. Whether LightDM's guest session works depends on the guest helper\ninstalled, so the option is turned off explicitly. The LightDM and SDDM checks read every\nconfiguration file in load order and keep the last value; they ignore sections, so a value\nset for one seat only counts for all. The automated fix covers GDM only; the LightDM and SDDM\nchecks were written from their documentation and not tested in a lab.\n", "setting": { "location": "/etc/gdm3/custom.conf, /etc/lightdm/lightdm.conf(.d), /etc/sddm.conf(.d)", "default_value": "Off, except LightDM allow-guest (true upstream)", "recommended_value": "No automatic, timed or guest login" }, "audit": { "manual": "1. GDM: `/etc/gdm3/custom.conf` must not set `AutomaticLoginEnable=true` or\n `TimedLoginEnable=true` in `[daemon]`.\n2. LightDM: the configuration must set `allow-guest=false`, and must not set\n `autologin-user` or `autologin-guest=true`.\n3. SDDM: no `User=` value in an `[Autologin]` section of `/etc/sddm.conf`,\n `/etc/sddm.conf.d/` or `/usr/lib/sddm/sddm.conf.d/`.\n", "checks": [ { "id": "gdm", "engine": "shell", "description": "GDM has no automatic or timed login.", "facts": [ "gdm" ], "spec": { "script": "[ -f /etc/gdm3/custom.conf ] || { echo \"no /etc/gdm3/custom.conf\"; exit 0; }\nrc=0\nfor k in AutomaticLoginEnable TimedLoginEnable; do\n v=$(K=$k awk '/^[ \\t]*\\[/ { h = $0; gsub(/^[ \\t]+|[ \\t]+$/, \"\", h); s = (h == \"[daemon]\"); next }\n s && $0 ~ \"^[ \\t]*\" ENVIRON[\"K\"] \"[ \\t]*=\" { v = $0; sub(/^[^=]*=[ \\t]*/, \"\", v); sub(/[ \\t]+$/, \"\", v) }\n END { print v }' /etc/gdm3/custom.conf)\n echo \"$k=${v:-unset}\"\n case $v in [Tt][Rr][Uu][Ee] | 1) rc=1 ;; esac\ndone\nexit \"$rc\"\n" } }, { "id": "lightdm", "engine": "shell", "description": "LightDM has no automatic login and no guest session.", "facts": [ "lightdm" ], "spec": { "script": "files=\nfor f in /usr/share/lightdm/lightdm.conf.d/*.conf /etc/xdg/lightdm/lightdm.conf.d/*.conf \\\n /etc/lightdm/lightdm.conf.d/*.conf /etc/lightdm/lightdm.conf; do\n [ -f \"$f\" ] && files=\"$files $f\"\ndone\nget() {\n # shellcheck disable=SC2086 # one word per file\n [ -n \"$files\" ] && K=$1 awk '$0 ~ \"^[ \\t]*\" ENVIRON[\"K\"] \"[ \\t]*=\" { v = $0; sub(/^[^=]*=[ \\t]*/, \"\", v); sub(/[ \\t]+$/, \"\", v) }\n END { print v }' $files\n}\ng=$(get allow-guest) u=$(get autologin-user) a=$(get autologin-guest)\necho \"allow-guest=${g:-unset} autologin-user=${u:-unset} autologin-guest=${a:-unset}\"\ncase $g in [Ff][Aa][Ll][Ss][Ee] | 0) ;; *) exit 1 ;; esac\n[ -z \"$u\" ] || exit 1\ncase $a in [Tt][Rr][Uu][Ee] | 1) exit 1 ;; esac\n" } }, { "id": "sddm", "engine": "shell", "description": "SDDM has no automatic login.", "facts": [ "sddm" ], "spec": { "script": "files=\nfor f in /usr/lib/sddm/sddm.conf.d/*.conf /etc/sddm.conf.d/*.conf /etc/sddm.conf; do\n [ -f \"$f\" ] && files=\"$files $f\"\ndone\n[ -n \"$files\" ] || { echo \"no SDDM configuration file\"; exit 0; }\n# shellcheck disable=SC2086 # one word per file\nu=$(awk 'FNR == 1 { s = 0 } /^[ \\t]*\\[/ { h = $0; gsub(/^[ \\t]+|[ \\t]+$/, \"\", h); s = (h == \"[Autologin]\"); next }\n s && /^[ \\t]*User[ \\t]*=/ { v = $0; sub(/^[^=]*=[ \\t]*/, \"\", v); sub(/[ \\t]+$/, \"\", v) }\n END { print v }' $files)\necho \"[Autologin] User=${u:-unset}\"\n[ -z \"$u\" ]\n" } } ] }, "remediation": { "manual": "- GDM: in `/etc/gdm3/custom.conf`, section `[daemon]`, set `AutomaticLoginEnable=false` and\n `TimedLoginEnable=false` (or remove the lines). The change applies when GDM restarts.\n- LightDM: in `/etc/lightdm/lightdm.conf`, section `[Seat:*]`, set `allow-guest=false`,\n `greeter-allow-guest=false`, and remove `autologin-user` and `autologin-guest`.\n- SDDM: remove `User=` from the `[Autologin]` section of the SDDM configuration files.\n", "effects": { "restart": "reboot", "disruption": "low", "lockout_risk": false }, "rollback": "Restore `/etc/gdm3/custom.conf` from the backup directory.\n", "scripts": [ { "id": "gdm", "engine": "shell", "facts": [ "gdm" ], "file": "fix.sh" } ] }, "references": [ { "title": "GNOME System Administration Guide - Log in automatically", "url": "https://help.gnome.org/admin/system-admin-guide/stable/login-automatic.html.en", "publisher": "The GNOME Project", "kind": "vendor-doc", "accessed": "2026-10-19" }, { "title": "sddm.conf(5), Ubuntu manual pages", "url": "https://manpages.ubuntu.com/manpages/noble/man5/sddm.conf.5.html", "publisher": "Canonical", "kind": "vendor-doc", "accessed": "2026-10-19" } ], "mappings": [ { "framework": "nist-800-53r5", "framework_version": "5.1.1", "id": "IA-2", "relation": "related" }, { "framework": "nist-800-53r5", "framework_version": "5.1.1", "id": "AC-14", "relation": "related" } ], "threats": [ { "framework": "mitre-attack", "id": "T1078" }, { "framework": "cwe", "id": "CWE-306" } ], "authors": [ { "name": "Alice", "github": "Sn0wAlice" } ], "verified": [ { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "20.04" ], "environment": "Proxmox VM with Ubuntu Desktop (GNOME 3.36, gdm3), Ubuntu 20.04.6, kernel 5.4.0-216-generic", "notes": "GDM check and fix tested (desktop-hardened) in /etc/gdm3/custom.conf, including AutomaticLoginEnable=True and TimedLoginEnable=1 turned off; GDM shows the login screen after reboot. The LightDM and SDDM checks were not tested (no such machine), only reported not applicable." }, { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "22.04" ], "environment": "Proxmox VM with Ubuntu Desktop (GNOME 42, gdm3), Ubuntu 22.04.5, kernel 5.15.0-198-generic", "notes": "GDM check and fix tested (desktop-hardened) in /etc/gdm3/custom.conf, including AutomaticLoginEnable=True and TimedLoginEnable=1 turned off; GDM shows the login screen after reboot. The LightDM and SDDM checks were not tested (no such machine), only reported not applicable." }, { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "24.04" ], "environment": "Proxmox VM with Ubuntu Desktop (GNOME 46, gdm3), Ubuntu 24.04.5, kernel 6.8.0-147-generic", "notes": "GDM check and fix tested (desktop-hardened) in /etc/gdm3/custom.conf, including AutomaticLoginEnable=True and TimedLoginEnable=1 turned off; GDM shows the login screen after reboot. The LightDM and SDDM checks were not tested (no such machine), only reported not applicable." }, { "date": "2026-10-19", "by": "Sn0wAlice", "versions": [ "26.04" ], "environment": "Proxmox VM with Ubuntu Desktop (GNOME 50, gdm3), Ubuntu 26.04.1, kernel 7.0.0-38-generic", "notes": "GDM check and fix tested (desktop-hardened) in /etc/gdm3/custom.conf, including AutomaticLoginEnable=True and TimedLoginEnable=1 turned off; GDM shows the login screen after reboot. The LightDM and SDDM checks were not tested (no such machine), only reported not applicable." } ], "introduced_in": "0.1.0", "created": "2026-10-19", "updated": "2026-10-19" } }