mediumservicesunverifiedrollback-safe

Ensure GDM disable-user-list option is enabled

gdm-disable-user-list · RHEL ≥ 8 · 1 impl

Description

If GNOME Display Manager is in use, the user list should be disabled to prevent username enumeration.

Rationale

Displaying usernames at login provides information that could be used in brute force attacks. Disabling the list improves security.

Check → Remediate

Checkcommand

if ! rpm -q gdm >/dev/null 2>&1; then exit 0; fi
val=$(DCONF_PROFILE=/etc/dconf/profile/gdm dconf read /org/gnome/login-screen/disable-user-list 2>/dev/null)
[ "$val" = "true" ]

expected_exit:: 0

Remediatedconf_set

schema:: org/gnome/login-screen
key:: disable-user-list
value:: true
file:: 00-security-settings
db:: gdm
lock:: true

Framework references

CIS

rhel9 1.8.3rhel8 1.8.2rhel10 1.8.2

STIG

V-258033 / RHEL-09-271115V-244536

NIST 800-53

AC-3AC-9CM-6

#gdm#gnome#user-list#security#stig