Screen Lock and Login Screen¶

On a desktop image the screen lock and the login screen are settings too. Mint uses the Cinnamon desktop (MATE on some images) with the LightDM login screen; Debian uses GNOME with GDM. The keys differ by desktop, the ideas don't.

Screen lock¶

For each human user (the README's list), the screen locks when idle (CIS 1.7.2):

Key (Cinnamon)	Key (GNOME, Debian)	Value	Why
`org.cinnamon.desktop.screensaver lock-enabled`	`org.gnome.desktop.screensaver lock-enabled`	true	Lock when the screensaver starts
`org.cinnamon.desktop.screensaver lock-delay`	`org.gnome.desktop.screensaver lock-delay`	5 or less (seconds)	Lock right away, not after a grace period
`org.cinnamon.desktop.session idle-delay`	`org.gnome.desktop.session idle-delay`	900 or less, not 0	Screensaver after 15 minutes idle

On the MATE edition the keys are org.mate.screensaver lock-enabled and idle-activation-enabled, with org.mate.session idle-delay in minutes (15).

gsettings set org.cinnamon.desktop.screensaver lock-enabled true
gsettings set org.cinnamon.desktop.screensaver lock-delay 5
gsettings set org.cinnamon.desktop.session idle-delay 900

gsettings acts on the account running it. To fix another user's settings, run as them: sudo -u bob dbus-launch gsettings set …. To set it for everyone and stop users changing it back, a dconf profile with a lock:

sudo mkdir -p /etc/dconf/db/local.d/locks /etc/dconf/profile
sudo nano /etc/dconf/profile/user

Two lines in that file tell dconf to read the system database after the user's:

user-db:user
system-db:local

Then the settings file, sudo nano /etc/dconf/db/local.d/00-security. It's an INI-style file: a [section] is the gsettings schema with dots turned into slashes, and each line under it is key=value. Two entries to start:

[org/cinnamon/desktop/screensaver]
lock-enabled=true
lock-delay=uint32 5

Numbers need the uint32 prefix. Add a [org/cinnamon/desktop/session] section with idle-delay=uint32 900, and a [org/cinnamon/desktop/media-handling] section with automount=false, automount-open=false, and autorun-never=true. To stop users changing them back, list the keys in a locks file, one full path per line:

sudo nano /etc/dconf/db/local.d/locks/00-security

/org/cinnamon/desktop/screensaver/lock-enabled
/org/cinnamon/desktop/session/idle-delay

Finish with sudo dconf update, which compiles the database and complains, with a line number, about anything it couldn't parse.

On Debian, replace org/cinnamon with org/gnome throughout and add the GNOME login-screen keys below. Users must log out and in for the system settings to take effect.

/etc/lightdm/lightdm.conf (create it if it doesn't exist; Mint's defaults live in /usr/share/lightdm/lightdm.conf.d/). Under [Seat:*]:

[Seat:*]
greeter-hide-users=true
allow-guest=false

greeter-hide-users=true (CIS 1.7.1) means the login screen doesn't list account names, so an attacker has to guess both halves. allow-guest=false removes the passwordless guest session. There must be no autologin-user= line unless the README asks for it. lightdm --show-config prints what LightDM actually loaded, from every file.

In the dconf file above, add:

[org/gnome/login-screen]
disable-user-list=true
banner-message-enable=true
banner-message-text='Authorized users only. All activity may be monitored and reported.'

And in /etc/gdm3/daemon.conf (or custom.conf), AutomaticLoginEnable=false under [daemon] and Enable=false under [xdmcp] (Debian CIS 1.7.6). XDMCP is a remote graphical login protocol with no encryption. The Debian benchmark numbers the GDM items separately: banner 1.7.1, user list 1.7.2, screen lock 1.7.3, automount 1.7.4, autorun 1.7.5. Its Level 2 item 1.7.7 sets WaylandEnable=false under [daemon] so GNOME runs on X11 instead of Wayland; that's a compatibility choice for some remote tools, and on a contest image it only matters if the README asks.

Removable media¶

Automount and autorun let a plugged-in USB drive open its files or run a program. The dconf file above sets automount=false, automount-open=false, and autorun-never=true (CIS 1.7.3) under media-handling.

Verify¶

gsettings get org.cinnamon.desktop.screensaver lock-enabled
gsettings get org.cinnamon.desktop.session idle-delay
gsettings get org.cinnamon.desktop.media-handling autorun-never
lightdm --show-config 2>&1 | grep -E 'hide-users|allow-guest|autologin'

The first three print true, 900, true. Log out and confirm the login screen shows no user list.

Example¶

gsettings get org.cinnamon.desktop.screensaver lock-enabled prints false for alice, and lightdm --show-config shows autologin-user=alice from /etc/lightdm/lightdm.conf.d/70-autologin.conf. Delete that file, write the dconf profile and locks, add greeter-hide-users=true, sudo dconf update, and log out to confirm.

Try it¶

Set idle-delay to 30 seconds and wait. Set it back.
Set greeter-hide-users and log out.

Build it¶

A desktop.sh that prints the gsettings get for each key on this page for the current user, and the lightdm --show-config lines that matter.

Next¶

Kernel Modules