<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 2/24/14, 6:07 PM, Maura Dailey
wrote:<br>
</div>
<blockquote cite="mid:530BD0AA.7030605@eclipse.ncsc.mil" type="cite">The
GConf settings we've been using for login banners and disabling
user lists have been replaced by Gnome 3's dconf parameters in
RHEL 7 (and Fedora, obviously). dconf allows users and admins to
set certain parameters with plain text key files. It also allows
admins to bypass key files and set parameters with a GVariant
binary blob file. There are some problems for us with both
methods. I'll use the login banner text settings as an example.
<br>
<br>
The recommended method in the RHEL 7 administration guide is to
create a text file in <i class="moz-txt-slash"><span
class="moz-txt-tag">/</span>etc/dconf/db/gdm.d<span
class="moz-txt-tag">/</span></i> that looks something like the
following:
<br>
<br>
[org/gnome/login-screen]
<br>
banner-message-enable=true
<br>
banner-message-text='Consent banner text'
<br>
<br>
After creating this file, the user must type dconf update, and the
settings are applied, making this a two step process. However,
there is a second way to apply the same settings, using the
gsettings tool, which will write the data as a binary data blob
into the home directory of whatever user runs the tool:
<br>
<br>
sudo -u gdm dbus-launch gsettings set org.gnome.login-screen
banner-message-enable true
<br>
<br>
This achieves the same effect and the consent banner will be
displayed to users in exactly the same way. This method is harder
to test, since there is no parseable text file for OVAL to
evaluate, but it is extremely easy to apply on the command line.
<br>
<br>
<br>
TLDR: Are we allowed to mandate that system administrators must
use the Red Hat guide's method of using plain text key files?
<br>
</blockquote>
<br>
dconf is verifiable, `gdm dbus-launch` is not. Seems reasonable to
recommend implementations which can be machine verified.<br>
<br>
Perhaps we could acknowledge the dbus-launch method in the
description tag, noting that machines configured in such a way may
report false positives (and to use dconf if this bothers the
sysadmin)<br>
<br>
<br>
<blockquote cite="mid:530BD0AA.7030605@eclipse.ncsc.mil" type="cite">
On a related note, the login banner text only displays AFTER users
have put in their user name, and there appears to be no way to
edit the consent banner's appearance without altering the GDM
theme. Instead, it's scrunched into a tiny window, with tiny grey
text on a grey background, with a scroll bar. Is it too late to
put this on my RHEL 7 final release wish list or can someone point
me to the correct settings?
<br>
</blockquote>
<br>
File an RFE ASAP:<br>
<a class="moz-txt-link-freetext" href="https://access.redhat.com/support/cases/new/">https://access.redhat.com/support/cases/new/</a><br>
</body>
</html>