/dev/chat

I am running an up-to-date installation of Arch Linux and GNOME 3.28. For security reasons I don't allow root login in the consoles. I have done this by configuring /etc/securetty. However, it worries me that in the GUI I can still login into the root account from the GNOME GDM login screen. Is...

Faheem Mitha

@PrabhjotSingh I mean, where you asking how to edit messages in chat?

If so, left click on the little downward pointing arrow at the beginning of the message.

You'll see a little menu pop up. This includes an edit option for 2 minutes.

Prabhjot Singh

Ok I try this

One disclosure @FaheemMitha

I haven't read Madam Bovary though suggested by my father

Kusalananda

@ParanoidPanda You can not disallow root from logging in when they have physical access. With physical access, one can easily reboot the machine into single user mode and acquire root access that way.

Faheem Mitha

@PrabhjotSingh Ok.

Kusalananda

4:56 PM

@ParanoidPanda Well, I'm assuming there are things you can do with the tty settings as well, but I'm not sure how they work on Linux.

user136984

@Kusalananda: You can't actually just reboot it and login as root or anything like that in fact. It's all configured so that you can't do that. And the /etc/securetty thing I mentioned in the question disables root login in the specified TTYs, it's just in the actual GNOME login screen that this is still possible.

user136984

And it's kind of bad practice I think to allow a root GUI login, especially when it is disabled elsewhere, there really should be a way of preventing this otherwise it's just silly.

Kusalananda

@ParanoidPanda Did you see "https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/4/html/S‌ecurity_Guide/s2-wstation-privileges-noroot.html"

It's RHEL, but Arch may do something similar.

user136984

@Kusalananda: 404 Error, page not found.

user136984

I don't know, Arch is really a do-it-yourself system, they barely change anything from the upstream, in fact that's practically the point of them. So the system you make is really what you make of it. So this would all probably be upstream GNOME stuff, and not downstream Arch related.

Kusalananda

5:03 PM

@ParanoidPanda Huh? I have it open in two tabs. In one it works, and in the other I get a 404. Weird.

user136984

But I can't read your page so I don't know what it says there.

user136984

I'll try again!

Kusalananda

access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/…

user136984

I get to it this time (with your actual link)!

user136984

How strange.

user136984

5:13 PM

@Kusalananda: OK, well, I have made the changes it specifies with the auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so setting. So I will restart now and let you know!

user136984

5:32 PM

@Kusalananda: It worked! Great! Thanks!

user136984

Please post that as an answer then.

Kusalananda

6:11 PM

@ParanoidPanda I will not do that as I have no equivalent system to test on. I hate giving out "blind" answers... But you could write it up as an answer to your own question!

@ParanoidPanda It's also far too hot here, so I can't really think straight... :-)

Faheem Mitha

@Kusalananda You could buy an A/C.

user136984

8:27 PM

@Kusalananda: Ok, I'll do that, but as it does work on my system, and you did find it, there's no real reason not to just point at that and say to try it. Let me know if you change your mind. But ok, I'll answer it. :)

Kusalananda

@ParanoidPanda I will not change my mind ;-)

user136984

@Kusalananda: Ok, I'll credit you in the answer then. ;)

user136984

There we go:

user136984

0

A: How to prevent root login from GNOME 3 login screen (Arch Linux)?

This can be achieved as stated here by adding the following line: auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so To these files (some may not already exist and have to be created): /etc/pam.d/gdm /etc/pam.d/gdm-autologin /etc/pam.d/gdm-fingerprint /etc/pam.d/...

user136984

@Kusalananda: Thanks! :)

Kusalananda

8:42 PM

@ParanoidPanda Looks good, as far as I can see. Take care. I'm going to bed.

user136984

@Kusalananda: Great! Thanks again and goodnight (hope the bedbugs don't bite)! ;-)

Transcript for