Disable the GNOME3 Login User List
Hides the list of user accounts on the GNOME (GDM) login screen by setting disable-user-list=true and locking the key.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
By default the GDM greeter shows a list of existing user accounts. Anyone with physical access can read these names and enumerate valid usernames without authenticating, giving an attacker half of every credential pair for free and aiding targeted phishing or brute-force attacks. Setting disable-user-list=true and locking it forces users to type their username, removing this free enumeration.
What Pavois checks
Pavois checks the effective dconf state: the last definition of disable-user-list across /etc/dconf/db/*.d/* must resolve to true, and the key /org/gnome/login-screen/disable-user-list must appear in a dconf lock file. Evaluating resolved precedence (last drop-in wins) plus the lock matches how dconf computes the value, catching a later drop-in that re-enables the list or unlocks the key.
only_if { command('dconf').exist? }
describe command('{ s=$(grep -rhE \'^[[:space:]]*disable-user-list[[:space:]]*=\' /etc/dconf/db/*.d/* 2>/dev/null | tail -1 | sed -E \'s/^[^=]*=[[:space:]]*//\' | tr -d "\'\\""); [ "$s" = "true" ] && grep -rqxF \'/org/gnome/login-screen/disable-user-list\' /etc/dconf/db/*/locks/* 2>/dev/null && echo ok; } || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
After dconf update, run gsettings get org.gnome.login-screen disable-user-list (should print true) and confirm the key is locked by checking /etc/dconf/db/*/locks/* for /org/gnome/login-screen/disable-user-list. The greeter should ask for a username instead of listing accounts.
Inspect & investigate
dconf has no runtime log; verify with gsettings get org.gnome.login-screen disable-user-list and inspect /etc/dconf/db/*.d/* and /etc/dconf/db/*/locks/*. Login attempts at the GDM greeter are recorded by the authentication stack, review with journalctl -u gdm and /var/log/auth.log (Debian/Ubuntu) or journalctl _COMM=gdm-session-worker / /var/log/secure (RHEL).
Remediation
Pavois's harden plan uses the dconf resource to write disable-user-list=true into a system dconf profile drop-in, add /org/gnome/login-screen/disable-user-list to a locks file, and run dconf update. Apply it with pavois harden apply.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | org/gnome/login-screen/disable-user-list |
|---|---|
| resource | dconf |
| value | true |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Applies only to GNOME/GDM hosts; irrelevant on headless servers. After applying, users must type their full username at login instead of clicking it, a minor usability change. No authentication is broken and no reboot is required; dconf update is sufficient. Precaution: inform desktop users of the new username-entry step to avoid help-desk confusion.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 1.7.3, 1.8.3, 1.8.2 | direct | per OS, see the benchmark table | high |
| NIST | AC-23, CM-6(a) | supporting | 800-53 Rev 5 · 800-171 Rev 2 (pinned) | medium |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.