Linux: Allow SSH Console Login But Not GDM / KDM / X Windows Based Login

I‘d like to only allow ssh or console based login (ssh, su, sudo commands) but restrict specific users from using GDM / KDM / X Windows based login under Linux operating systems. How do I stop direct GUI user login using GDM / KDM / X Windows login managers and only allow text based logins?

The GNOME Display Manager (GDM) or KDE Display Manager (KDM) provides a simpler alternative (read as replacement for XDM) display manager for the X Window System’s XDM. The easiest way to restrict access to GDM/KDM is to use “Pluggable Authentication Modules” for GDM or KDM which provide dynamic authorization for applications and services in a Linux system.

Step #1: Create Deny User Lists

Create a text file called /usr/local/etc/kdm.deny or /usr/local/etc/gdm.deny, enter:
# vi /usr/local/etc/gdm.deny
Add each username on a separate line. In this example, deny access to user tom, jerry, spike, tyke, butch etc:

tom
jerry
spike
tyke
butch

Save and close the file. You can to use the same file for kdm using ln command:
# ln -s /usr/local/etc/gdm.deny /usr/local/etc/kdm.deny
Any user name present in these file will no longer be able to login via GDM (GNOME) or KDM (KDE) systems. But, those users can still login using ssh or use su and/or sudo commands.

Step #2: Restrict GDM User Login

Edit /etc/pam.d/gdm, enter:
# vi /etc/pam.d/gdm
Append / modify line as follows:

auth   required   pam_listfile.so onerr=fail item=user sense=deny file=/usr/local/etc/gdm.deny

Save and close the file.

Step #3: Restrict KDM User Login

Edit /etc/pam.d/kdm, enter:
# vi /etc/pam.d/kdm
Append / modify line as follows:

auth   required   pam_listfile.so onerr=fail item=user sense=deny file=/usr/local/etc/gdm.deny

Save and close the file.

See also:

• Linux PAM configuration that allows or deny login via the sshd server