<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 10/17/12 5:57 PM, Andrew Gilmore
wrote:<br>
</div>
<blockquote
cite="mid:CAD1s7uyUuOVaDkiPAXWAyYQv=-JEzNTAnUwdbSAQ4Ny4tftPSg@mail.gmail.com"
type="cite">
<div>Jeff said: </div>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">Yes -- there
has been an outstanding ticket for<br>
"research security-relevant gconf settings" for quite a while:</blockquote>
<div><br>
</div>
<div>I twigged to this by looking at Steve Grubb's kickstart
scripts for securing at install, and wondered where this group
was. </div>
<div> </div>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
If you'd like to take stab at it, patches are welcome!<br>
</blockquote>
<div><br>
</div>
<div>lol, we'll see after I get a chance to finish my server
install to test the project. </div>
<div><br>
</div>
<div>And Maura and Shawn pointed out ways to turn this off</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px
0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><span
style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">GDM
by default will read from the gconf settings folder in<br>
</span><span
style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px;background-color:rgb(255,255,255)">the
gdm user's home directory (/var/lib/gdm/.gconf).</span></blockquote>
<div><br>
</div>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
gconftool-2 -s /apps/gdm/simple-greeter/disable_user_list true<br>
</blockquote>
<div><br>
</div>
<div>I implemented something that I'm not sure is sufficient:</div>
<div> gconftool-2 --direct
--config-source=xml:readwrite:/etc/gconf/gconf.xml.mandatory \</div>
<div> -t bool -s /apps/gdm/simple-greeter/disable_user_list true</div>
</blockquote>
<br>
IIRC, much of the existing content around gconf was blindly
inherited from the RHEL5 SNAC. Due diligence hasn't been done to see
what holds over to RHEL6.<br>
<br>
<br>
<blockquote
cite="mid:CAD1s7uyUuOVaDkiPAXWAyYQv=-JEzNTAnUwdbSAQ4Ny4tftPSg@mail.gmail.com"
type="cite">
<div>Testing is the easier way, but I would think that the gdm
user's .gconf has already been populated at creation, and
therefore misses this setting that occurs after installation?</div>
<div>Where is the right place to put changes like these? Should I
be changing <span
style="background-color:rgb(255,255,255);color:rgb(34,34,34);font-family:arial,sans-serif;font-size:13px">/var/lib/gdm/.gconf?</span></div>
</blockquote>
The gconftool-2 utility can persistently chance the various values.
I'm a big proponent of letting tools do their job, versus writing
scripts to edit .gconf files directly (why write a script/tool when
one already exists?).<br>
<br>
gconftool-2 -s to set a boolean, -g to verify it seems simple
enough.<br>
<br>
<br>
</body>
</html>