documentation_complete: true

prodtype: rhel7,fedora

title: 'Disable the GNOME3 Login User List'

description: "In the default graphical environment, users logging\ndirectly into the system are greeted with a login screen that displays\nall known users. This functionality should be disabled by setting\n<tt>disable-user-list</tt> to <tt>true</tt>.\n<br /><br />\nTo disable, add or edit <tt>disable-user-list</tt> to \n<tt>/etc/dconf/db/gdm.d/00-security-settings</tt>. For example:\n<pre>[org/gnome/login-screen]\ndisable-user-list=true</pre>\nOnce the setting has been added, add a lock to\n<tt>/etc/dconf/db/gdm.d/locks/00-security-settings-lock</tt> to prevent user modification.\nFor example:\n<pre>/org/gnome/login-screen/disable-user-list</pre>\nAfter the settings have been set, run <tt>dconf update</tt>."

rationale: |-
    Leaving the user list enabled is a security risk since it allows anyone
    with physical access to the system to quickly enumerate known user accounts
    without logging in.

severity: medium

identifiers:
    cce@rhel7: 80106-8

references:
    nist: AC-23

ocil_clause: 'disable-user-list has not been configured or is not disabled'

ocil: |-
    To ensure the user list is disabled, run the following command:
    <pre>$ grep disable-user-list /etc/dconf/db/gdm.d/*</pre>
    The output should be <tt>true</tt>.
    To ensure that users cannot enable displaying the user list, run the following:
    <pre>$ grep disable-user-list /etc/dconf/db/gdm.d/locks/*</pre>
    If properly configured, the output should be <tt>/org/gnome/login-screen/disable-user-list</tt>
