Bug 723708 - gdm can neither exclude from nor add to login users generated by the system
gdm can neither exclude from nor add to login users generated by the system
Status: CLOSED NOTABUG
Product: Fedora
Classification: Fedora
Component: gdm (Show other bugs)
20
x86_64 Linux
unspecified Severity high
: ---
: ---
Assigned To: Ray Strode [halfline]
Fedora Extras Quality Assurance
: Reopened
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2011-07-20 16:35 EDT by George Walsh
Modified: 2014-11-25 23:46 EST (History)
36 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-09-21 19:18:45 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
GNOME Desktop 655075 None None None Never

  None (edit)
Description George Walsh 2011-07-20 16:35:38 EDT
Description of problem:
This version of gdm displays by default all login users with uid >= 500. There is no way to limit this list by excluding specified users to better manage the login access. Further, because the length of the login list is not manageable, the display as a whole becomes useless because the display is not scrollable.

Version-Release number of selected component (if applicable):
gdm-3.0.4-1.fc15.x86_64

How reproducible:
Assuming the server has defined login users (ie, uid >= 500), attempt to remove or add to the 'default' list.

Steps to Reproduce:
In /etc/gdm/custom.conf, under the [greeter] header, use the IncludeAll, Include, and Exclude equates to attempt to add or remove known login users from the display. Reboot the system to ensure all updating takes place. 


  
Actual results:

No effect whatever

Expected results:
Addition or deletion of known users from the newly generated display.

Additional info:
Comment 1 Gene Snider 2011-10-12 14:38:17 EDT
Please see the thread at http://forums.fedoraforum.org/showthread.php?t=246103.  This bug is affecting many people.

Gene
Comment 2 Christian Jose 2011-10-17 15:44:34 EDT
Even with the latest updates, this 'bug' is still exists.

I've spent hours trying to work out why editing /etc/gdm/custom.conf has no effect when attempting to exclude users.

My system has a 'test' user and a user that purely exists to run a weekly script - I really don't want these wasting valuable space in the Graphical login. In fact for security reasons, I would rather they were not advertised to the world.
Comment 3 George Walsh 2011-10-17 19:41:31 EDT
Thanks for further confirmation of my original report, Christian.

Seems to me this would be a major annoyance to anyone who is doing some development work on a machine which is also handling mail and web services for an 'in-house' group.

When 16 is released next month I intend to work around it by manipulating user account numbers and have done with it, since the dividing line is being moved up from 500 to 1000, and have done with it once and for all.
Comment 4 Alfredo Ferrari 2011-11-02 03:04:46 EDT
This bug is terribly annoying. On a machine with >>10 accounts, if your one is at the end of the list you cannot login at all. Or a way of scrolling the list is provided, or the functionality of Include/Exclude is restored as soon as possible. BTW it affects i386 as well
Comment 5 amturnip 2011-11-12 11:58:41 EST
The following in /etc/gdm/custom.conf still has no apparent effect in Fedora 16.

[greeter]
Include=
IncludeAll=false
Exclude=me
Comment 6 Christian Jose 2011-11-12 14:57:08 EST
It's interesting to note that gdm appears to follow the rule set in /etc/login.defs (UID_MIN) - I am still running Fedora 15 (I can't move to Fedora 16 easily for a number of reasons) but in anticipation, migrated all personal user accounts to be above UID 1000 and then updated /etc/login.defs - gdm no longer displays the accounts with UIDs below 1000.
Comment 7 Matt Mossholder 2011-11-23 11:54:17 EST
This one is biting me too, custom.conf doesn't appear to have any effect. From some other things I have read, GDM3 has migrated to dconf/gsettings, and there are no equivalent settings for Include/Exclude/IncludeAll yet. There is a key to disable the userlist entirely, but it isn't honored yet.

<sigh>
Comment 8 George Walsh 2011-11-25 14:01:44 EST
Thanks, Matt, for helping me feel less isolated on this one. I have taken back some control of the gdm list by deciding which users to renumber from >= 500 to >= 1000. Heaven alone knows how many revisions and updates and rebuilds since I first filed this in July - with no attention at all to the simple matter of logging in.

I'm not one to overly complain and I have been a Linux/Unix server user for years, but the fact that my servers lack a functional front door out-of-the-box is beyond comprehension. Rather like living in a house with a front door for which nobody owns a key and for which there is no key supplied anyway. 

The pity is that once inside, the decor and styling and efficiency is unbeatable. But in this day and age, few are they who will pound on an unfinished piece of rough plywood to gain entry .....
Comment 9 Marcus Moeller 2011-11-30 10:37:56 EST
Any update on that?
Comment 10 George Walsh 2011-12-08 13:42:09 EST
None whatsoever, Marcus.

I really don't expect Fedora/Redhat to be able to do much about this after going on 6 months. Its a GNOME problem.

Did I file a big with them? No, that would be a waste of both time and purpose. There are so many bugs untouched over there that I clearly, if sadly, came to the conclusion that a bug in GNOME's world requires not investigation on their part but extermination. They just haven't found the 'poison' to accomplish that yet.

Too many narcissists in the GNOME household; far too much arrogance within a truly non-profit, idealistic product.

Personally, I like GNOME 3 very much, and I would not change simply because nobody is maintaining gdm to any degree suggesting it is truly integrated with the desktop as a whole. Matter of fact, I've used GNOME all the way back to 2001.
Comment 11 Peter Bieringer 2012-02-11 10:30:25 EST
Hit by same problem on Fedora 16, can one change the version or clone the bug? /etc/gdm/custom.conf (while packaged with gdm RPM) is ignored at least regarding [greeter] settings.
Comment 12 Caleb Maclennan 2012-02-11 17:54:34 EST
Same problem on generic gdm install on PLD. Neither the /etc/gdm/custom.conf nore /usr/share/gdm/gdm.schemas have any effect. This affects many many systems and is quite bothersome to some of my clients.
Comment 13 Nayden Isapov 2012-04-11 01:36:19 EDT
It's still an issue (using /etc/gdm/custom.conf) for Fedora 16 and gdm-3.2.1.1-8.fc16.i686. Changing the setting from Configuration Editor (gui editor) to disable the list at all does not work either:

Key name: /apps/gdm/simple-greeter/disable_user_list
Comment 14 Nayden Isapov 2012-04-11 01:38:32 EDT
forgot to mention that the key value is 'true':

Key name:  /apps/gdm/simple-greeter/disable_user_list
Key value: true
Comment 15 Peter Bieringer 2012-05-05 01:27:54 EDT
(In reply to comment #14)
> forgot to mention that the key value is 'true':
> 
> Key name:  /apps/gdm/simple-greeter/disable_user_list
> Key value: true

not working because this results in a user configuration only, not globally:

# more /home/$USER/.gconf/apps/gdm/simple-greeter/%gconf.xml 
<?xml version="1.0"?>
<gconf>
	<entry name="disable_user_list" mtime="1336193113" type="bool" value="true"/>
</gconf>

where to apply this globally?
Comment 16 Thomas Spear 2012-06-20 17:04:17 EDT
Still an issue in Fedora 17. Matter of fact, I renumbered the user I want hidden from >=1000 to >=500 and it still appears, so there is now a new regression. I'll be filing a new bug report for that one.
Comment 17 Thomas Spear 2012-06-20 19:43:36 EDT
Bug 834134 submitted
Comment 18 Thomas Spear 2012-06-20 19:46:42 EDT
As an update, I even went as far as changing the user's UID to <500 and changed /etc/login.defs so that SYS_UID_MIN and SYS_GID_MIN were both 501 ... Still appears. The only way I've found to easily exclude the user from the login screen was to change their shell to something like /bin/false, /sbin/nologin, /dev/null, etc.
Comment 19 Thomas Spear 2012-06-20 19:48:42 EDT
One more update. I also setup /etc/security/access.conf to deny all local access to the account, and made sure that that worked in a virtual console (had to create a copy of system-auth-ac, and symlink system-auth to that copy, per the pam docs). Then I rebooted and gdm still showed the account.
Comment 20 Fedora End Of Life 2012-08-07 14:28:56 EDT
This message is a notice that Fedora 15 is now at end of life. Fedora
has stopped maintaining and issuing updates for Fedora 15. It is
Fedora's policy to close all bug reports from releases that are no
longer maintained. At this time, all open bugs with a Fedora 'version'
of '15' have been closed as WONTFIX.

(Please note: Our normal process is to give advanced warning of this
occurring, but we forgot to do that. A thousand apologies.)

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, feel free to reopen
this bug and simply change the 'version' to a later Fedora version.

Bug Reporter: Thank you for reporting this issue and we are sorry that
we were unable to fix it before Fedora 15 reached end of life. If you
would still like to see this bug fixed and are able to reproduce it
against a later version of Fedora, you are encouraged to click on
"Clone This Bug" (top right of this page) and open it against that
version of Fedora.

Although we aim to fix as many bugs as possible during every release's
lifetime, sometimes those efforts are overtaken by events. Often a
more recent Fedora release includes newer upstream software that fixes
bugs or makes them obsolete.

The process we are following is described here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping
Comment 21 Marcus Moeller 2012-08-08 02:45:29 EDT
Changed release to F17 as this one is still valid.
Comment 22 Gerry Graesser 2012-11-06 18:28:33 EST
Fedora 17 work-around to this issue:

     # ln -s /bin/bash /usr/local/sbin/nologin

     # edit /etc/passwd  # Update login shell to /usr/local/sbin/nologin

Then the login for the particular user(s) will no longer appear via GDM
but you can still login by selecting "other" and entering the login and
password.
Comment 23 Mark Harfouche 2013-01-22 12:19:39 EST
Still a bug in F18 (x86_64)...
Comment 24 David Raker 2013-01-28 08:54:02 EST
For anyone just finding this, it appears to have been broken during a change here:

http://git.gnome.org/browse/gdm/commit/gui/simple-greeter/gdm-user-chooser-widget.c?id=ec034f78dcb27baf240658323892ac2a665c6580

It is getting worked on,though, here:

https://bugs.freedesktop.org/show_bug.cgi?id=56729
Comment 25 George Walsh 2013-01-29 19:47:16 EST
This goes all the way back to July 2011.

What I finally did for my small development team is move their user accounts to the 1000+ range. Always, of course there were those whose feathers were ruffled, unwilling to appreciate that I meant them no disrespect because they were not among the 6 users gdm was able to display. But hey, it provided a better 'filter' of sorts for gdm's selection process.

I have, however, always felt that the 'front door' should work faultlessly. First impressions and all that. 

I was looking at Mageia the other day (I came to Fedora from Mandriva a few years back, after all. They have addressed that issue in their upcoming V3 by simply adding a scroll function to the gdm display manager. Could we maybe consider doing that much at least?

In the meantime FWIW, a fully loaded and functioning server with f18 is doing splendidly, oce you manage to 'get inside'.

Thanks for all the comments and suggestions on this bug made over these past many months.

George
Comment 26 Mark Harfouche 2013-01-29 19:51:11 EST
even the users with less than 1000 UID are shown on my computer...... this is super annoying when you create users to run websites in a more sandboxed manner....
Comment 27 Gabriel M. Elder 2013-02-18 11:40:29 EST
GDM ignores settings in /etc/gdm/custom.conf, specifically, I've tried:

[greeter]
Exclude=someuser

and

[greeter]
IncludeAll=false

and it still lists ALL usernames.

I have yet to find some other, more preferred method to have gdm hide usernames on the login greeter. Clearly, I'm either missing something, or the configurability of gdm is horribly broken.
Comment 28 Gabriel M. Elder 2013-02-18 17:52:09 EST
For those still searching, here's a workaround to make the gdm greeter screen display a simple "Username:" prompt instead of divulging a list of users:

As root, create and edit a file e.g. "/etc/dconf/db/gdm.d/01-local-settings". Minimally, it should contain:

###
# local system-wide customizations

[org/gnome/login-screen]
disable-user-list=true
###

and then run "dconf update". Once you logout or restart gdm, your happiness quotient will improve. This worked for me in f18.

See also: https://ask.fedoraproject.org/question/3515/solved-how-do-i-disable-user-list-in-gdm
Comment 29 Thomas Spear 2013-02-18 18:16:31 EST
This workaround, IMHO, should be included in a future update of the graphical system-config-* tools so that one can make changes to the greeter easily from the GUI.
Comment 30 Satish Balay 2013-03-21 18:32:23 EDT
On F16 - I was able to use uid/gid < 500 - and avoid the user listed in gdm. Now this machine is upgraded to f18 - and the user gets listed. :(

Interestingly there is one user 'mysql in /etc/passwd with /bin/bash - but doesn't get listed by gdm?
Comment 31 Satish Balay 2013-03-21 19:03:04 EDT
(In reply to comment #22)
> Fedora 17 work-around to this issue:
> 
>      # ln -s /bin/bash /usr/local/sbin/nologin
> 
>      # edit /etc/passwd  # Update login shell to /usr/local/sbin/nologin
> 
> Then the login for the particular user(s) will no longer appear via GDM
> but you can still login by selecting "other" and entering the login and
> password.

Works on F18. Thanks!
Comment 32 Fedora End Of Life 2013-07-04 02:30:19 EDT
This message is a reminder that Fedora 17 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 17. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '17'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 17's end of life.

Bug Reporter:  Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 17 is end of life. If you 
would still like  to see this bug fixed and are able to reproduce it 
against a later version  of Fedora, you are encouraged  change the 
'version' to a later Fedora version prior to Fedora 17's end of life.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.
Comment 33 Mark Harfouche 2013-07-04 03:46:49 EDT
Still a bug in F19. See Comment 24 for the upstream proposed patch.
Comment 34 Fedora End Of Life 2013-08-01 14:05:42 EDT
Fedora 17 changed to end-of-life (EOL) status on 2013-07-30. Fedora 17 is 
no longer maintained, which means that it will not receive any further 
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of 
Fedora please feel free to reopen this bug against that version.

Thank you for reporting this bug and we are sorry it could not be fixed.
Comment 35 Neil Bird 2013-08-02 03:01:09 EDT
I don't know whether this is current or not (I still have not had the chance to update my box from Fedora 16), but for anyone with this issue (only wanting to show certain users on the new greeter), I achieved it with a hack to

/usr/share/gnome-shell/js/gdm/loginDialog.js

Look for the "addUser" function; at the end of all the normal "don't do it, just return" initial lines, add a custom one.  The relevant snippet in mine looks like:

        let userName = user.get_user_name();

        if (!userName)
            return;

if (userName != "user1" && userName != "user2" && userName != "user3")
return;

        this.removeUser(user);

(the addition is the bit with no indent)
Comment 36 Arun S A G 2013-08-02 05:39:43 EDT
This is still a problem in Fedora 19. Reopening
Comment 37 Jos de Kloe 2014-01-04 08:12:04 EST
And the same problem persists in Fedora 20. Still no effect at all of changing the file /etc/gdm/custom.conf
And what's worse, the workaround mentioned in comment #22 does no longer seem to work for me...
Meanwhile the "ongoing" work mentiond in comment #24 seems to be still ongoing.

I understand this is a gnome issue, not a Fedora one, so we probably have to wait for upstream. Are there any suggestions for a new workaround to exclude a single user from the list in gdm?
Comment 38 Jos de Kloe 2014-01-30 15:24:49 EST
a simple workaround that works for me now (contrary to what is mentioned in comment #26) is to manually change the user id to a free number below 1000. I have used 501 and this hides the user in the greeter. 
For convenience I also assigned this user a group id below 1000 (also 501). Don't know if that makes any difference.
Comment 39 George Walsh 2014-01-30 21:06:59 EST
That should work fine for you. From experience though, you'll need to remember the user you change to < 1000 will not appear in your users & groups displays when you are managing their accounts. Obvious, I know, but it can be frustrating when you are looking for a user in your user display and that user has apparently not answered roll call :-) Easy to get by switching the filter off and on, but these are the nuisance things which were not thought out at the time. Probably would help if the gdm script included a warning comment to 'enforce' what has become general practice. I don't see the problem anymore, simply because user password and shadow files are maintained across linux installs or updates on our server and we reorganized our uid/gid 2 years ago to isolate all login accounts to uid > 1000.

Assume you are doing the same. If you must bite a bullet, best to do it right away. Much less painful. Far better prognosis, too.

GJW
Comment 40 tony 2014-07-14 11:48:24 EDT
You can try editing/creating /var/lib/AccountsService/users/{theUserYouWantToExclude} with this content:


[User]
Language=
XSession=gnome
SystemAccount=true


It seems setting SystemAccount to true has the same effect as creating/changing the userid to < 1000, but in this case it is flagged as a system account while keeping the original userid.
Comment 41 Jos de Kloe 2014-09-11 09:56:11 EDT
(In reply to tony from comment #40)
> You can try editing/creating
> /var/lib/AccountsService/users/{theUserYouWantToExclude} with this content:

thanks. 
The UID<1000 trick actually stopped working for me on Fedora 20, don't know why, but editing this file and marking the account as SystemAccount does the trick.
Comment 42 Peter Larsen 2014-09-20 22:23:05 EDT
So this F15 bug is still open with F20? I ran into this too - either close it and say WHY this feature is needed, or make a simple change to the login code.
Comment 43 George Walsh 2014-09-21 19:18:45 EDT
Peter:

There are so many comments and variations on this messy gdm bug, and having seen it closed and reopened over the past 3 years (and 6 fedora revs) I have wiped my hands of it.

Not my place to make 'simple changes', nor to substantiate the need for a functioning gdm in a gnome-centric distro.

So I have marked this closed from my point of view as the original reporter of the bug. 

Others are then free to report their experiences, hopefully with a new bug so I am no longer copied on it.

Hopefully, GNOME will have addressed this with the coming 3.14 release this week and it will be embedded in f21 as a result.


George
Comment 44 Peter Larsen 2014-09-22 10:52:30 EDT
(In reply to George Walsh from comment #43)
Thanks George. I appreciate the feedback.

> Peter:
> 
> There are so many comments and variations on this messy gdm bug, and having
> seen it closed and reopened over the past 3 years (and 6 fedora revs) I have
> wiped my hands of it.

It's been closed without explaining why a simple feature like excluding certain users could not be fixed? That's the gist of my question. We shouldn't keep an issue open for 3 years that's not being worked on. 

> 
> Not my place to make 'simple changes', nor to substantiate the need for a
> functioning gdm in a gnome-centric distro.

Conceptually filtering out content based on a list of names is not complex code. If you already have a loop that gets system users to display, checking against a simple list retrieved from the configuration before showing the user list isn't rocket science. While I emphasize about not trivilaizing bugs, over complicating them isn't working either.

I would like to understand why this issue cannot be addressed. Are we talking to the wrong group? Should this be filed with gnome and not fedora/red hat? If so, I'll be happy to create a entry on bugzilla.gnome.org and link it here. However, when I look around it seems this still works in some distros so it looks more like a non-generic gnome bug. But if there is a doubt it seems to be the right initial approach. At worst, gnome.org can reject it as NOTABUG and we're back to discussing where in Fedora to fix this.

> So I have marked this closed from my point of view as the original reporter
> of the bug. 

I appreciate you reporting the issue. I wish more would do what you did. What is missing seems to be someone who can triage this from a technical perspective and assign it to the right technical resource.

> Others are then free to report their experiences, hopefully with a new bug
> so I am no longer copied on it.

10-4. I have no problem opening a new issue on this. From one community member to another, again thanks for your effort on this long lasting bug.

> Hopefully, GNOME will have addressed this with the coming 3.14 release this
> week and it will be embedded in f21 as a result.

The only problem I have with that sentence is "hopefully". Nothing just happens and as I pointed out, other distros seems to not suffer from this issue (could be they use a very old version of gdm). 

> 
> George

Thanks again for reporting this initially.
Comment 45 Thomas Spear 2014-09-22 12:44:14 EDT
The case with other distros is likely that those distros fixed it in their own builds of gdm. The fact that in 4+ releases of fedora, this hasn't been fixed, tells me either it's not a priority for them or, as per the norm, fedora doesn't fix bugs in upstream code, only in the code they add on top of upstream. Which means that they're waiting for upstream to fix and that won't happen until it's reported upstream.
Comment 46 Peter Larsen 2014-09-22 14:03:25 EDT
(In reply to Thomas Spear from comment #45)
> The case with other distros is likely that those distros fixed it in their
> own builds of gdm. The fact that in 4+ releases of fedora, this hasn't been
> fixed, tells me either it's not a priority for them or, as per the norm,
> fedora doesn't fix bugs in upstream code, only in the code they add on top
> of upstream. Which means that they're waiting for upstream to fix and that
> won't happen until it's reported upstream.

Then shouldn't this bug have been marked with a bug report on bugzilla.gnome.org where the issue was described directly to the upstream? It makes no sense to wait for a solution for a problem that hasn't been filed - or at least linked. I just added the link to this issue on gnome's bugzilla to let others know to go there to continue the push for a fix.

Note You need to log in before you can comment on or make changes to this bug.