The Gnome Display Manager (GDM) is a PAM application providing graphical login. The following sections document how to configure and use GDM with smart card authentication.
The Gnome Display Manager (GDM) is a PAM application providing graphical login. The following sections document how to configure and use GDM with smart card authentication.
To configure PAM, run the following command:
vastool smartcard configure pam gdm
Typically, GDM initially displays an Insert card: prompt if you have specified the smart card-only option; otherwise it displays a Insert card or enter username: prompt. Once you have entered the username, it displays a PIN: prompt.
NOTE: You can select themes for GDM. The theme that you select may not display prompts or additional information from the pam_vas_smartcard module, or it may display both prompts and additional information.
You can modify how the prompts display in one of these ways:
In the [pam_vas] section of vas.conf, specify new prompts using the prompt-vassc-user and prompt-vassc-pin options ;
Specify the prompt-style=text option of the pam_vas_smartcard module.
This displays the prompts in that section of the GDM theme that display PAM messages, while not displaying anything in that section of the theme that display PAM prompts;
Specify the prompt-style=both option of the pam_vas_smartcard module.
This displays the prompts in that section of the GDM theme that display PAM messages, while displaying Username: and PIN: in that section of the theme that display PAM prompts.
Only select the prompt-style and show-token-status options if the theme supports the display of PAM messages. It may be necessary to select the prompt-style=text or prompt-style=both options if the theme does not support the display of PAM prompts, or if the prompts appear to be truncated.
If the theme displays PAM messages and you want token status messages to display, specify the show-token-status=clear option.
NOTE: some themes or versions of GDM may not display PAM messages correctly, or may fail to erase previous PAM messages. You must carefully consider the use of the prompt-style and show-token-status=clear options and only select them if the overall display is suitable. One Identity recommends that you use a simple theme that displays PAM prompts without truncation.
Register PKCS#11 Module in NSSDB
For many readers and cards, the default PKCS#11 library contains the ciphers and mechanisms needed to work with those cards. However, in the case that the default library does not work with the readers or cards, the NSSDB needs to be updated so the GDM greeter can recognize when a card is inserted. For example, to remove CoolKey and insert OpenSC into NSSDB, one could run the following commands:
/bin/modutil -delete "CoolKey PKCS #11 Module" -dbdir sql:/etc/pki/nssdb/
/bin/modutil -dbdir sql:/etc/pki/nssdb -add "OpenSC PKCS#11 Library" -libfile /usr/lib64/opensc-pkcs11.so
For more information on how to use modutil, see man modutil or visit https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/tools/NSS_Tools_modutil.
One Identity recommends that you disable remote login for GDM by disabling the X display manager control protocol (XDMCP). XDMCP is disabled by default; however, you can manually disable XDMCP.
To edit the GDM Configuration file manually
Open the GDM configuration file.
This file is typically located at /etc/X11/gdm/gdm.conf, however local settings may take precedence. You can find the local settings in /etc/X11/gdm/factory-gdm.conf file.
Look for the [XDMCP] section and verify that the Enable property is either not present, commented out, or is set to false, as follows:
[XDMCP] Enable=false.
NOTE: Whether modifying the GDM configuration manually or by using the graphical user interface, you must restart GDM.
© 2024 One Identity LLC. ALL RIGHTS RESERVED. Conditions d’utilisation Confidentialité Cookie Preference Center