highsystemverified ✓rollback-safe

Disable automatic logon via graphical user interface

gdm-no-autologin · RHEL ≥ 8 · 1 impl

Description

The GNOME Display Manager (GDM) must not be configured to allow unattended or automatic logon. The AutomaticLoginEnable setting in /etc/gdm/custom.conf must be set to false.

Rationale

Unattended or automatic logon bypasses authentication mechanisms and allows anyone with physical access to the system to gain access without credentials. This eliminates accountability and audit trail for physical access.

Check → Remediate

Checkcommand

if ! rpm -q gdm >/dev/null 2>&1; then exit 0; fi
val=$(grep -i '^\s*AutomaticLoginEnable\s*=' /etc/gdm/custom.conf 2>/dev/null |
      awk -F= '{print $2}' | tr -d ' ' | tr '[:upper:]' '[:lower:]')
[ "$val" = "false" ] || [ -z "$val" ]

expected_exit:: 0

Remediateconfig_set

path:: /etc/gdm/custom.conf
key:: AutomaticLoginEnable
value:: false
separator:: =

Framework references

STIG

V-258018 / RHEL-09-271040V-230329

NIST 800-53

AC-3IA-2CM-6

Live verification

rhel8:check

#gdm#graphical#autologin#authentication#stig