List of user accounts

Shawn Wells shawn at redhat.com
Wed Oct 17 22:06:22 UTC 2012


On 10/17/12 5:57 PM, Andrew Gilmore wrote:
> Jeff said:
>
>     Yes -- there has been an outstanding ticket for
>     "research security-relevant gconf settings" for quite a while:
>
>
> I twigged to this by looking at Steve Grubb's kickstart scripts for 
> securing at install, and wondered where this group was.
>
>     If you'd like to take stab at it, patches are welcome!
>
>
> lol, we'll see after I get a chance to finish my server install to 
> test the project.
>
> And Maura and Shawn pointed out ways to turn this off
>
>     GDM by default will read from the gconf settings folder in
>     the gdm user's home directory (/var/lib/gdm/.gconf).
>
>
>     gconftool-2 -s /apps/gdm/simple-greeter/disable_user_list true
>
>
> I implemented something that I'm not sure is sufficient:
>  gconftool-2 --direct 
> --config-source=xml:readwrite:/etc/gconf/gconf.xml.mandatory \
>   -t bool -s /apps/gdm/simple-greeter/disable_user_list true

IIRC, much of the existing content around gconf was blindly inherited 
from the RHEL5 SNAC. Due diligence hasn't been done to see what holds 
over to RHEL6.


> Testing is the easier way, but I would think that the gdm user's 
> .gconf has already been populated at creation, and therefore misses 
> this setting that occurs after installation?
> Where is the right place to put changes like these? Should I be 
> changing /var/lib/gdm/.gconf?
The gconftool-2 utility can persistently chance the various values. I'm 
a big proponent of letting tools do their job, versus writing scripts to 
edit .gconf files directly (why write a script/tool when one already 
exists?).

gconftool-2 -s to set a boolean, -g to verify it seems simple enough.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/scap-security-guide/attachments/20121017/87710a31/attachment-0001.html>


More information about the scap-security-guide mailing list