Linux: Allow SSH Console Login But Not GDM / KDM / X Windows Based Login

by on May 6, 2010 · 4 comments· LAST UPDATED May 6, 2010

in

I'd like to only allow ssh or console based login (ssh, su, sudo commands) but restrict specific users from using GDM / KDM / X Windows based login under Linux operating systems. How do I stop direct GUI user login using GDM / KDM / X Windows login managers and only allow text based logins?

The GNOME Display Manager (GDM) or KDE Display Manager (KDM) provides a simpler alternative (read as replacement for XDM) display manager for the X Window System's XDM. The easiest way to restrict access to GDM/KDM is to use "Pluggable Authentication Modules" for GDM or KDM which provide dynamic authorization for applications and services in a Linux system.

Step #1: Create Deny User Lists

Create a text file called /usr/local/etc/kdm.deny or /usr/local/etc/gdm.deny, enter:
# vi /usr/local/etc/gdm.deny
Add each username on a separate line. In this example, deny access to user tom, jerry, spike, tyke, butch etc:

tom
jerry
spike
tyke
butch

Save and close the file. You can to use the same file for kdm using ln command:
# ln -s /usr/local/etc/gdm.deny /usr/local/etc/kdm.deny
Any user name present in these file will no longer be able to login via GDM (GNOME) or KDM (KDE) systems. But, those users can still login using ssh or use su and/or sudo commands.

Step #2: Restrict GDM User Login

Edit /etc/pam.d/gdm, enter:
# vi /etc/pam.d/gdm
Append / modify line as follows:

auth   required   pam_listfile.so onerr=fail item=user sense=deny file=/usr/local/etc/gdm.deny

Save and close the file.

Step #3: Restrict KDM User Login

Edit /etc/pam.d/kdm, enter:
# vi /etc/pam.d/kdm
Append / modify line as follows:

auth   required   pam_listfile.so onerr=fail item=user sense=deny file=/usr/local/etc/gdm.deny

Save and close the file.

See also:

TwitterFacebookGoogle+PDF versionFound an error/typo on this page? Help us!

{ 4 comments… read them below or add one }

1 Aaron May 6, 2010 at 4:33 pm

Could this be used to create a whitelist for GDM/KDM? In other words deny all and then create an gdm.allow file to allow only certain users?

Reply

2 nixCraft May 6, 2010 at 6:10 pm

Yes, just replace

sense=deny

with

sense=allow

Reply

3 Alex August 10, 2010 at 7:27 am

I created a whitelist for authorized users I want to allow with this method; unfortunately it didn’t work. What could I be missing. Thanks in advanced. I am using RHEL 5.

Reply

4 JohnD November 1, 2010 at 2:39 am

Try using NXserver and client. You can limit by group.

Reply

Leave a Comment

Tagged as:

Previous Faq:

Next Faq: