The Gnome Display Manager (GDM) is a PAM application providing graphical login. The following sections document how to configure and use GDM with smart card authentication.
The Gnome Display Manager (GDM) is a PAM application providing graphical login. The following sections document how to configure and use GDM with smart card authentication.
To configure PAM
vastool smartcard configure pam gdm
Typically, GDM initially displays an Insert card: prompt if you have specified the smart card-only option; otherwise it displays a Insert card or enter username: prompt. Once you have entered the username, it displays a PIN: prompt.
Note that you can select themes for GDM. The theme that you select may not display prompts or additional information from the pam_vas_smartcard module, or it may display both prompts and additional information.
You can modify how the prompts display in one of these ways:
This displays the prompts in that section of the GDM theme that display PAM messages, while not displaying anything in that section of the theme that display PAM prompts;
This displays the prompts in that section of the GDM theme that display PAM messages, while displaying Username: and PIN: in that section of the theme that display PAM prompts.
Only choose the prompt-style and show-token-status options if the theme supports the display of PAM messages. It may be necessary to choose the prompt-style=text or prompt-style=both options if the theme does not support the display of PAM prompts, or if the prompts appear to be truncated.
If the theme displays PAM messages and you want token status messages to display, specify the show-token-status=clear option.
Note that some themes or versions of GDM may not display PAM messages correctly, or may fail to erase previous PAM messages. You must carefully consider the use of the prompt-style and show-token-status=clear options and only choose them if the overall display is suitable. One Identity recommends that you use a simple theme that displays PAM prompts without truncation.
Register PKCS#11 Module in NSSDB
For many readers and cards, the default PKCS#11 library contains the ciphers and mechanisms needed to work with those cards. However, in the case that the default library does not work with the readers or cards, the NSSDB needs to be updated so the GDM greeter can recognize when a card is inserted. For example, to remove CoolKey and insert OpenSC into NSSDB, one could run the following commands:
For more information on how to use modutil, see man modutil or visit https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/tools/NSS_Tools_modutil.
One Identity recommends that you disable remote login for GDM by disabling the X display manager control protocol (XDMCP). XDMCP is disabled by default; however, you can manually disable XDMCP.
To edit the GDM Configuration file manually
This file is typically located at /etc/X11/gdm/gdm.conf, however "local" settings may take precedence. You can find the local settings in /etc/X11/gdm/factory-gdm.conf file.
[XDMCP] Enable=false.
Note: Whether modifying the GDM configuration manually or by using the graphical user interface, you must restart GDM.
© ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center