cis-ubuntu1804-v220-1-8-3

name	cis-ubuntu1804-v220-1-8-3
description	Ensure GDM disable-user-list option is enabled
category	cis-networking
version	2.2.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-18.04","gdm","gnome","disable-user-list","dconf"]
cis_id	1.8.3
cis_benchmark	CIS Ubuntu Linux 18.04 LTS Benchmark v2.2.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

1.8.3 Ensure GDM disable-user-list option is enabled (Automated)

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

GDM is the GNOME Display Manager which handles graphical login for GNOME based systems.

The disable-user-list option controls if a list of users is displayed on the login screen.

Rationale

Displaying the user list eliminates half of the Userid/Password equation that an unauthorized person would need to log on.

Audit Procedure

Command Line

Run the following script and to verify that the disable-user-list option is enabled or GNOME isn't installed:

#!/usr/bin/env bash

{
    l_pkgoutput=""
    if command -v dpkg-query > /dev/null 2>&1; then
        l_pq="dpkg-query -s"
    elif command -v rpm > /dev/null 2>&1; then
        l_pq="rpm -q"
    fi
    l_pcl="gdm gdm3" # Space separated list of packages to check
    for l_pn in $l_pcl; do
        $l_pq "$l_pn" > /dev/null 2>&1 && l_pkgoutput="$l_pkgoutput\n - Package: \"$l_pn\" exists on the system\n - checking configuration"
    done
    if [ -n "$l_pkgoutput" ]; then
        output="" output2=""
        l_gdmfile="$(grep -Pril '^\h*disable-user-list\h*=\h*true\b' /etc/dconf/db)"
        if [ -n "$l_gdmfile" ]; 
            output=
            l_gdmprofile=.
             grep -Pq  /etc/dconf/profile/; 
                output=
            
                output2=
            
             [ -f  ]; 
                output=
            
                output2=
            
        
            output2=
        
         [ -z  ]; 
             -e 
        
             -e 
            [ -n  ] &&  -e 
        
    
         -e 
    
}