Re: [gdm-list] Allowing password-less connexions

[Milan Bouchet-Valat <nalimilan club fr>]

Le vendredi 02 mai 2008 à 22:51 +0200, Maarten de Boer a écrit :
> Hi Milan,
> 
> Almost a year ago, I ran into the same problem, and posted the following
> solution to the list.
> 
> Maarten
> 
> 
> From: Maarten de Boer <mdeboer iua upf es>
> To: gdm-list gnome org
> Subject: login without password
> Date: Fri, 8 Jun 2007 12:11:58 +0200
> 
> Hello,
> 
> Yesterday, I setup my system (Ubuntu 7.04, though I am pretty sure it
> is a common issue) to allow password-less login for my daughter. The
> gdmsetup utility has the security option for autologin, which almost
> does what I want, but not quite.
> 
> So I found the gdm.conf option PasswordRequired=false, but this wasn't
> enough; I also had to create a file containing the usernames allowed to
> do passwordless login, and modify my /etc/pam.d/gdm.conf to contain:
> 
> auth sufficient pam_listfile.so sense=allow file=/etc/gdm/nopassword item=user
Very interesting, thanks. This means that the control of users allowed
to login without password is system-wide, as long as we give the same
list file to gdm, gnome-screensaver and the like (possibly for KDE too).
We should add a control about securetty so that only local connexions
are possible without password. But this would just require to be tweaked
by the distributions.

What would be needed then is a GUI to set this easily. Maybe the best
would be to use a PolicyKit mechanism so that permission can be granted
to users to add/remove them from password-less connexions list without
needing root priviledges. Is that correct?