No automatic login configured
Ensures the display manager (GDM or LightDM) does not enable automatic login, so a session is never opened without authentication.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
Why this rule matters
Automatic login opens a fully authenticated desktop session with no password the moment the machine boots. Anyone with physical access, including a stolen laptop or an unattended workstation, gets the user's full privileges instantly, and any service or agent in that session runs unprotected. Requiring an interactive login at the display manager restores the most basic access control on the console.
What Pavois checks
Pavois greps the effective display-manager configuration trees, /etc/gdm3, /etc/gdm and /etc/lightdm, recursively for any uncommented autologin directive. Scanning the whole directory (not a single file) catches the setting wherever a distro or admin placed it, including conf.d drop-ins.
describe command('grep -rqiE \'^[^#]*autologin\' /etc/gdm3 /etc/gdm /etc/lightdm 2>/dev/null && echo ko || echo ok') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run grep -riE '^[^#]*autologin' /etc/gdm3 /etc/gdm /etc/lightdm 2>/dev/null, it should return nothing (no active autologin line). On GDM, confirm AutomaticLoginEnable=true is absent from /etc/gdm3/custom.conf; on LightDM, confirm autologin-user= is unset.
Inspect & investigate
Login/session events go to journalctl -u gdm (or lightdm) and to /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL). An autologin shows as a session opened at boot with no PAM authentication prompt for that user.
Remediation
No automated remediation is shipped, so apply it manually: in /etc/gdm3/custom.conf set AutomaticLoginEnable=false (or remove the line); in LightDM, remove or comment autologin-user= (and autologin-user-timeout) under [Seat:*]. Restart the display manager or reboot for it to take effect.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | grep -rilE 'autologin' /etc/gdm3 /etc/gdm /etc/lightdm 2>/dev/null # in /etc/gdm3/custom.conf set: AutomaticLoginEnable=false (remove the AutomaticLogin lines) |
|---|---|
| reason | disabling autologin is safe but verify no kiosk/appliance relies on it |
| resource | manual |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Disabling autologin is low risk but changes user experience: the machine will require an interactive password at every boot. On kiosks, digital signage or single-user appliances that rely on unattended boot-to-desktop, removing autologin can break the intended workflow, plan an alternative (locked-down kiosk account, screen lock) before applying. On servers and shared workstations this is purely a security improvement.