Red Hat Bugzilla – Bug 58114
kdm divulges user accounts
Last modified: 2007-04-18 12:38:55 EDT
When using kdm in standard configuration (ie, no user browser), typing a correct account name into the login box is often enough to divulge the fact that the account name is correct. Normally, the Session_Type dialog box displays "Default" as the session type. If a user has a different session type set in his or her home directory, this Session_Type box automatically changes to display the preferred Session_type, even before a password is typed. Under some circumstances, this can be used to determine whether an account exists on the system or not. To fix this, the Session_Type should not be checked by KDM until after the username *and* password have been verified.
This is true with the skipjack public beta as well. In KDE3, before the password is even entered, the Session_Type changes to the previous session for valid users. This feedback reveals the existance of accounts....
Please retry with current version of Fedora Core. Unless you followup on this bug, it will be considered fixed and will be closed at some point... Thank you for your time.
Red Hat Linux is no longer supported by Red Hat, Inc. If you are still running Red Hat Linux, you are strongly advised to upgrade to a current Fedora Core release or Red Hat Enterprise Linux or comparable. Some information on which option may be right for you is available at http://www.redhat.com/rhel/migrate/redhatlinux/. Closing as CANTFIX.