.TH gdm 8 "28 Dec 2015"

.SH "NAME"

gdm \- GDM (GNOME Display Manager)

.SH "SYNOPSIS"

.PP

\fB/usr/sbin/gdm\fR [\fB--help\fR] [\fB--fatal-warnings\fR] [\fB--timed-exit\fR] [\fB--version\fR]

.SH "DESCRIPTION"

.PP

GDM is the GNOME Display Manager, a program used for login session management\&.

GDM supports managing the console display, other attached displays, XDMCP

displays, and flexible (or on-demand) displays\&.  Flexible displays make use

of the Virtual Terminals (VT) interfaces to allow user switching, so that

multiple users can run simultaneous sessions sharing the same console\&.

GDM uses ConsoleKit to manage what sessions are active on the system\&.

GDM supports a number of configuration interfaces which are described in

later sections of this manpage\&.

.PP

For each display that GDM is configured to manage, the

\fBgdm\fR program will launch a slave daemon which does the

work to actually manage the display\&.  The slave daemon will start the login

greeter GUI program, the program that the user interacts with\&.  Refer to the

"Login Greeter GUI" section below for more information about how the

user interface works\&.

.PP

If Virtual Terminals are supported on your system, you can start a flexible

display via the "User Switcher" panel applet\&.  You may need to add

this applet to your panel to make use of it\&.  You can also use the 

\fBgdmflexiserver\fR(1)

command to start flexible displays from the command line\&.

.PP

On Solaris, the GDM service is managed by the 

\fBsmf\fR(7)

service management facility under the service identifier

\fIsvc:/application/graphical-login/gdm\fR\&.

On Solaris, it is recommended that you use the

\fBsvcadm\fR(8) utility to enable and disable the

"gdm" service instead of killing the daemon with a SIGTERM signal.

.PP

GDM supports libaudit and Solaris auditing\&.  Refer to the 

"System Administration Guide: Security Services" and the

\fBaudit\fR(8) manpage for more information\&.

On Solaris, GDM also uses

\fBlogindevperm\fR(5)

to ensure that device permissions are set properly for the user on login\&.

.SH "OPTIONS"

.PP

The following options are supported by \fBgdm\fR:

.TP 30

.B --fatal-warnings

Make all warnings fatal\&.  Useful for debugging\&.

.TP 30

.B --help

Display detailed usage message\&.

.TP 30

.B --timed-exit

Exit after 30 seconds\&.  Useful for debugging\&.

.TP 30

.B --version

Display the GDM version\&.

.SH "ENVIRONMENT VARIABLES"

.PP

See

\fBenviron\fR(5)

for descriptions of environment variables\&.

.PP

When the following description refers to "scripts", these are

referring to the GDM \fBInit\fR, \fBPostLogin\fR,

\fBPreSession\fR, and \fBPostSession\fR scripts\&.

.TP 30

.B DESKTOP_SESSION

For any user session started by GDM, this environment variable is set to the

session name the user has chosen in the login GUI, such as "gnome" to

indicate that the \fB/usr/share/xsession/gnome\&.desktop\fR

session file was used to launch the session\&. 

.TP 30

.B DISPLAY

When running scripts and for any user session started by GDM, this environment

variable is set to the Xserver display value associated with the session\&.

.TP 30

.B DESKTOP_SESSION

For any user session started by GDM, this environment variable is set to the

keyboard layout that the user has chosen in the login GUI\&.

.TP 30

.B HOME

When running scripts and for any user session started by GDM, this environment

variable is set to the home directory associated with the user\&.

.TP 30

.B LANG

For any user session started by GDM, this environment variable is set to the

langauge choice selected when the user logged in\&.

.TP 30

.B REMOTE_HOST

When running scripts, this environment variable is set to the hostname if the

session is non-local (e\&.g\&. XDMCP)\&.

.TP 30

.B RUNNING_UNDER_GDM

When running scripts, this environment variable is set to "true", so

that they can identify when they are executed by the GDM process\&.

.TP 30

.B SHELL

When running scripts and for any user session started by GDM, this environment

variable is set to the shell associated with the session\&.

.TP 30

.B USER

When running scripts and for any user session started by GDM, this environment

variable is set to the username associated with the session\&.

.TP 30

.B USERNAME

When running scripts and for any user session started by GDM, this environment

variable is set to the username associated with the session\&.

.TP 30

.B XAUTHORITY

When running scripts and for any user session started by GDM, this environment

variable is set to the Xserver Xauthority file being used by the session\&.

.TP 30

.B XDG_SESSION_COOKIE

This environment variable is provided by ConsoleKit, and this value is set

for any user session started by GDM so that ConsoleKit can properly identify

the session\&.

.SH "EXTENDED DESCRIPTION"

.SS "Login Greeter GUI"

.PP

The login greeter GUI allows the user to specify how their user session should

be started and ensures that the user authenticates before gaining access to

their user session\&.  Authentication can be disabled if desired\&.

.PP

GDM makes use of

\fBpam\fR(3PAM)

to manage how the user authenticates (for example, by entering a username and

password, via a SmartCard, fingerprint reader, etc\&.)\&.  If authentication is

not desired, then GDM provides two configuration options which can be used

to bypass it: "Automatic Login" and "Timed Login"\&.  These

are not enabled by default, but can be turned on if desired\&.

.PP

The Automatic Login feature will cause GDM to bypass the login greeter GUI

entirely and immediately start a session for the user specified in the GDM

configuration\&.  The Timed Login feature will display the login greeter GUI for

a number of seconds specified in the GDM configuration\&.  If no user logs in

before the timeout, then GDM will automatically start the user session for the

user specified in the GDM configuration\&.  Timed Login is useful if you wish to

have the opportunity to login as a different user on some occasions\&.  Obviously

neither Automatic Login or Timed Login are secure, and they should only be used

on systems where the security provided by authentication is not needed\&.

.PP

GDM normally uses a PAM stack named "gdm"\&.  When Automatic Login or

Timed Login is enabled, then GDM instead uses a PAM stack named

"gdm-autologin"\&.  Note that Automatic Login and Timed Login will not

work properly if the "gdm-autologin" PAM stack is not defined in your

PAM configuration\&.

.PP

The login greeter GUI provides two mechanisms for specifying which user is

logging into the system\&.  Either the "Face Browser" can be used,

or GDM can prompt the user with the requests specified by the system PAM

configuration\&.  By default, this means entering both the username and password

by hand\&.

.PP

The Face Browser is designed to work when PAM is configured to allow users to

select their username, so it is not useful with certain PAM configurations

(such as when the username is identified via a SmartCard or fingerprint)\&.  The

Face Browser obviously exposes usernames to anyone with access to the machine,

so users may wish to disable it if this is considered a security issue\&.

.PP

When the Face Browser is enabled, a list of users will appear in the login

greeter GUI\&.  An icon for each user is shown, and users can specify what icon

is associated with their user\&.  If the user has an image file named

\fB~/\&.face\fR, then GDM will associate this image with the user\&.

If the user does not have such an image file, a default icon is displayed\&.

Image files must be no larger than 64K in size, or they are ignored by GDM\&.

.PP

The login greeter GUI can be configured to provide "Shutdown",

"Restart", and "Suspend" buttons which allow the user to

shutdown, restart, or suspend the system if desired\&.  On Solaris, the buttons

will only be available if the "solaris\&.system\&.shutdown" authorization name is

specified for the "gdm" user in the

\fB/etc/user_attr\fR file\&.  For example, the

\fB/etc/user_attr\fR file should include the following line to

make these buttons available from the GDM login GUI screen\&.

.PP

.nf

gdm::::type=normal;auths=solaris\&.system\&.shutdown

.fi

.PP

While the login greeter GUI is displayed, a panel is provided at the bottom

of the screen which provides useful information, interfaces that allow the

user to specify how their session should be started, and interfaces to help

the user navigate the login screen\&.  These include:

.sp

.in +2

\(bu

.mk

.in +3

.rt

A clock, showing the date and time\&.

.in -3

\(bu

.mk

.in +3

.rt

What type of session to run\&.

.in -3

\(bu

.mk

.in +3

.rt

An alternative language to use\&.

.in -3

\(bu

.mk

.in +3

.rt

An alternative keyboard layout (if supported)\&.

.in -3

\(bu

.mk

.in +3

.rt

The ability to launch assistive technology programs if desired\&.

.in -3

\(bu

.mk

.in +3

.rt

The ability to monitor the system battery (if using a system with a battery)\&.

.sp

.in -3

.in -2

.PP

The login greeter GUI also allows the user to take a screenshot\&.  If the

user presses the keybindng associated with printing the screen, then the

\fBgdm-screenshot\fR is run to take the screenshot\&.

.SS "Accessibility"

.PP

GDM supports accessibility\&.  Users can click on the accessibility icon on

the panel to specify which assistive programs should be launched with the

login GUI programs\&.  It is also possible to configure a system so that 

needed assistive programs should always be launched\&.

.SS "Security"

.PP

The GDM login GUI programs are run with a dedicated user id and group id\&.

By default "gdm" is used for both the user id and group id, but these

values are configurable\&.  The reason for using this special user and group is

to make sure that the GDM user interfaces run as a user without unnecessary

privileges, so that in the unlikely case that someone finds a weakness in the

GUI, they will not gain access to a privileged account on the machine\&.

.PP

Note that the GDM user and group do have some privileges beyond what a normal

user has\&.  This user and group has access to the Xserver authorization

directory which contains all of the Xserver authorization files and other

private information\&.  This means that someone who gains the GDM user/group

privileges can then connect to any running Xserver session\&.  Do not, under any

circumstances, make the GDM user/group a user/group that might be easy to get

access to, such as the user "\fBnobody\fR"\&.

.PP

File permissions are set on the authorization files so that only the user

has read and write access to ensure that users are unable to access the 

authorization files belonging to other users\&.

.SS "XDMCP"

.PP

XDMCP (X Display Manager Control Protocol) displays the login screen

and resulting session on a remote machine over the network interface\&.

By default, XDMCP is disabled in GDM\&.  However, GDM can be configured

to enable XDMCP so that users can log into the system from remote hosts\&.

By default, GDM listens to UDP port 177, although this can be configured\&.

GDM responds to QUERY and BROADCAST_QUERY requests by sending a WILLING

packet to the originator\&.

.PP

GDM provides configuration options that make GDM more resistant to

denial-of-service attacks on the XDMCP service\&.  The default values should

work for most systems, but several protocol parameters, handshaking timeouts,

and so on can be fine-tuned to make it more secure\&.  It is not recommended

that you modify the XDMCP configuration unless you know what you are doing\&.

.PP

GDM grants access to the hosts specified in the GDM service section of your

TCP Wrappers configuration file\&.  Refer to the \fBlibwrap\fR(3)

manpage for more information\&.  GDM does not support remote display access

control on systems without TCP Wrapper support\&.

.PP

GDM can also be configured to honor INDIRECT queries and present a host

chooser to the remote display\&. GDM remembers the user\&'s choice and forwards

subsequent requests to the chosen manager\&. GDM also supports an extension

to the protocol which makes GDM forget the redirection once the user\&'s

connection succeeds\&.  This extension is only supported if both daemons are

GDM\&. This extension is transparent and is ignored by XDM or other daemons

that implement XDMCP\&.

.PP

GDM only supports the MIT-MAGIC-COOKIE-1 authentication system\&. Because of

this, the cookies are transmitted as clear text\&. Therefore, you should be

careful about the network where you use this\&. That is, be careful about

where your XDMCP connection is going\&. Note that if snooping is possible, an

attacker could snoop your password as you log in, so a better XDMCP

authentication would not help you much anyway\&. If snooping is possible and

undesirable, you should use \fBssh\fR(1) for tunneling an X connection, rather

then using GDM\&'s XDMCP\&. Think of XDMCP as a sort of graphical telnet,

with the same security issues\&.

.SS "GDM Configuration"

.PP

ConsoleKit interfaces are used to configure how GDM should manage displays

in a multiseat environment, so to configure multiseat please refer to the

\fBconsole-kit-daemon\fR(8)

manpage\&.

.PP

GDM also provides a number of configuration interfaces which allow the user to

specify how GDM should operate\&.  The configuration available for the GDM

daemon and the GDM login greeter GUI are described below\&.  GDM also provides

scripting interfaces and other interfaces to configure how sessions are started

which are described in the "GDM Login Scripts and Session Files"

section of this manpage\&.

.PP

The default system configuration for the GDM daemon is stored in the file

\fB/etc/gdm/gdm\&.schemas\fR, and accessed by GDM via GConf\&.

Users are not recommended to modify this file since it may be overwritten on

upgrade\&.  Instead users should override these settings by specifying values

in the \fB/etc/gdm/custom\&.conf\fR file, which is in standard INI format\&.

.PP

The settings below are in "group/key=\fIdefault_value\fR \fItype\fR" format\&.

The type can be \fIstring\fR, \fIinteger\fR, or \fIboolean\fR\&.  To override

the "xdmcp/Enable" value, you would modify the

\fB/etc/gdm/custom\&.conf\fR so it contains these lines:

.PP

.nf

[xdmcp]

Enable=true

.fi

.PP

The following keys are supported for configuring the GDM daemon:

.sp

.ne 2

.mk

\fBchooser/Multicast=false (boolean)\fR

If true and IPv6 is enabled, the chooser will send a multicast query to the

local network and collect responses from the hosts who have joined multicast

group\&. 

.sp

.ne 2

.mk

\fBchooser/MulticastAddr=ff02::1 (string)\fR

This is the Link-local Multicast address\&.

.sp

.ne 2

.mk

\fBdaemon/TimedLoginEnable=false (boolean)\fR

If the user given in TimedLogin should be logged in after a number of seconds

(set with TimedLoginDelay) of inactivity on the login screen\&. This is useful

for public access terminals or perhaps even home use\&. If the user uses the

keyboard or browses the menus, the timeout will be reset to TimedLoginDelay or

30 seconds, whichever is higher\&. If the user does not enter a username but just

hits the ENTER key while the login program is requesting the username, then GDM

will assume the user wants to login immediately as the timed user\&. Note that no

password will be asked for this user so you should be careful, although if

using PAM it can be configured to require password entry before allowing login\&.

.sp

.ne 2

.mk

\fBdaemon/TimedLogin= (string)\fR

This is the user that should be logged in after a specified number of seconds

of inactivity\&.  If the value ends with a vertical bar | (the pipe symbol), then

GDM will execute the program specified and use whatever value is returned on

standard out from the program as the user\&. The program is run with the DISPLAY

environment variable set so that it is possible to specify the user in a

per-display fashion\&. For example if the value is

"/usr/bin/getloginuser|", then the program

\fB/usr/bin/getloginuser\fR will be run to get the user value\&. 

.sp

.ne 2

.mk

\fBdaemon/TimedLoginDelay=30 (integer)\fR

Delay in seconds before the TimedLogin  user will be logged in\&.

.sp

.ne 2

.mk

\fBdaemon/AutomaticLoginEnable=false (boolean)\fR

If true, the user given in AutomaticLogin  should be logged in immediately\&.

This feature is like timed login with a delay of 0 seconds\&.

.sp

.ne 2

.mk

\fBdaemon/AutomaticLogin= (string)\fR

This is the user that should be logged in immediately if AutomaticLoginEnable

is true\&.  If the value ends with a vertical bar | (the pipe symbol), then GDM

will execute the program specified and use whatever value is returned on

standard out from the program as the user\&. The program is run with the DISPLAY

environment variable set so that it is possible to specify the user in a

per-display fashion\&. For example if the value is

"/usr/bin/getloginuser|", then the program

\fB/usr/bin/getloginuser\fR will be run to get the user value\&. 

.sp

.ne 2

.mk

\fBdaemon/User=gdm (string)\fR

The username under which the greeter and other GUI programs are run\&.

.sp

.ne 2

.mk

\fBdaemon/Group=gdm (string)\fR

The group id used to run the login GUI programs

.sp

.ne 2

.mk

\fBdebug/Enable=false (boolean)\fR

If true, then GDM will provide debug output in the system log, which is

either \fB/var/log/messages\fR or

\fB/var/adm/messages\fR depending on your system\&.

.sp

.ne 2

.mk

\fBgreeter/IncludeAll=false (boolean)\fR

If true, then the face browser will show all users on the local machine\&. If

false, the face browser will only show users who have recently logged in\&.

.sp

When this key is true, GDM will call fgetpwent() to get a list of local users

on the system\&.  Anyusers with a user id less than 500 (or 100 if running on

Solaris) are filtered out\&.  The Face Browser also will display any users that

have previously logged in on the system (for example NIS/LDAP users)\&. It gets

this list via calling the

\fBck-history\fR(1)

ConsoleKit interface\&. It will also filter out any users which do not have a

valid shell (valid shells are any shell that getusershell() returns -

\fB/sbin/nologin\fR or \fB/bin/false\fR are

considered invalid shells even if getusershell() returns them)\&.

.sp

If false, then GDM more simply only displays users that have previously logged

in on the system (local or NIS/LDAP users) by calling the

\fBck-history\fR(1)

ConsoleKit interface\&.

.sp

.ne 2

.mk

\fBgreeter/Include= (string)\fR

Set to a list of users to always include in the Face Browser\&.  This value

is set to a list of users separated by commas\&.  By default, the value is

empty\&.

.sp

.ne 2

.mk

\fBgreeter/Exclude=bin,root,daemon,adm,lp,sync,shutdown,halt,mail,news,uucp,operator,nobody,nobody4,noaccess,postgres,pvm,rpm,nfsnobody,pcap (string)\fR

Set to a list of users to always exclude in the Face Browser\&.  This value

is set to a list of users separated by commas\&.  Note that the setting in the

\fBcustom\&.conf\fR overrides the default value, so if you wish

to add additional users to the list, then you need to set the value to the

default value with additional users appended to the list\&.

.sp

.ne 2

.mk

\fBgreeter/ShowLast=false (boolean)\fR

If true, then the session, language and layout dialogs in the login greeter GUI

will show the option "Last" by default\&.  The users default settings

in their \fB~/\&.dmrc\fR file will be used\&.  If no settings exist

in this file, then the system defaults will be used\&.  Note that GDM normally

caches the user\&'s \fB~/\&.dmrc\fR in the

\fB/var/cache/gdm\fR directory\&.  Turning on this feature causes

GDM to avoid using the cache, and instead accesses the user\&'s configuration

settings from their \fB~/\&.dmrc\fR file after

\fBpam_setcred\fR(3PAM) is called\&.

This feature is useful in situations where users might log into multiple

servers and the system administrator wants to avoid situations where the

user\&'s cached settings might become inconsistent across different servers\&.

.sp

.ne 2

.mk

\fBsecurity/DisallowTCP=false (boolean)\fR

If true, then always append "-\fBnolisten\fR tcp" to the

Xserver command line when starting attached Xservers, thus disallowing TCP

connection\&.  This is a more secure configuration if you are not using remote

connections\&.  Note that on Solaris, the

\fBoptions/tcp_listen\fR property of the 

\fBx11-server\fR service also controls whether this option is

appended to the Xserver command line\&.  The GDM configuration value is set to

"false" by default on Solaris to defer control of this feature to

this \fBx11-server\fR property\&.  Refer to the

\fBXserver\fR(1)

manpage for more information\&.

.sp

.ne 2

.mk

\fBxdmcp/DisplaysPerHost=1 (integer)\fR

To prevent attackers from filling up the pending queue, GDM will only allow

one connection for each remote computer\&. If you want to provide display

services to computers with more than one seat, you should increase this

value\&.  Note that the number of attached DISPLAYS allowed is not limited\&.

Only remote connections via XDMCP are limited by this configuration option\&. 

.sp

.ne 2

.mk

\fBxdmcp/Enable=false (boolean)\fR

Setting this to true enables XDMCP support allowing remote displays/X terminals

to be managed by GDM\&.  If GDM is compiled to support it, access from remote

displays can be controlled using the TCP Wrappers library\&.

.sp

.ne 2

.mk

\fBxdmcp/HonorIndirect=true (boolean)\fR

Enables XDMCP INDIRECT choosing for X-terminals which do not supply their own

display browser\&. 

.sp

.ne 2

.mk

\fBxdmcp/MaxPending=4 (integer)\fR

To avoid denial of service attacks, GDM has fixed size queue of pending

connections\&. Only MaxPending displays can start at the same time\&.  Please

note that this parameter does not limit the number of remote displays which

can be managed\&. It only limits the number of displays initiating a

connection simultaneously\&. 

.sp

.ne 2

.mk

\fBxdmcp/MaxSessions=16 (integer)\fR

Determines the maximum number of remote display connections which will be

managed simultaneously\&. I\&.e\&. the total number of remote displays that

can use your host\&.