Linux Ubuntu – How to Switch Users Without Entering Password

linuxpasswordsUbuntuubuntu-9.10users

I'm a newbie running Ubuntu 9.10. I have two users (wife and me), and each user's screensaver is set to lock so that on wakeup, we get to choose which user's desktop to go to. However, Ubuntu requires a password, so this is pretty tedious.

I'd like to switch users without entering any password. I know about this trick that works for the boot login, but it doesn't deal with multiple users.

Is it possible to set empty passwords for users in Ubuntu, or skip the password in other ways?

(I'm expecting real Linux users to suggest that passwordless users must not get any rights and there be an admin user with a strong password. Yes, you're right. But that's not what this question is about. Thanks.)

Best Answer

There is a way to achieve password-less logins in GDM by monkeying with GDM and/or PAM configurations. This is not the same as setting an empty password, or having GDM auto-login a given user; and it only works in GDM -- logging in on the text console, or via SSH, or using sudo, still requires a password.

This is from this recent post under an older UbuntuForums HowTo on enabling passwordless logins in GDM. I've used this method before with success, under Ubuntu 9.04; I don't know if it's still viable for Ubuntu 9.10.

Adding this line to the beginning of /etc/pam.d/gdm (make a backup!) tells PAM that the foo user doesn't need to give a password to login to GDM:

auth   sufficient   pam_succeed_if.so user = foo

If your users are all in some group (say, group family), you could give this capability to all family users with this line instead:

auth   sufficient   pam_succeed_if.so user ingroup family

This works on the basic GDM login screen; I'm not sure if it will work with the coming-back-from-screensaver.

Related Solutions

Linux – How to wake from screensaver directly to the login screen in Ubuntu

You're making a habit of weird tweaks, aren't you?

Anyway, this one is weird, but interesting. I'm sorry to say I don't have a complete solution, but I found a couple of interesting items that warrant a response. They may give you some ideas of where to go from here.

Gnome-Screensaver's FAQ indicates that the screensaver emits a DBus signal when the session's idle status changes:

Is there a way to perform actions when the screensaver activates or deactivates? Or when the session becomes idle?

One way is to watch for the D-Bus signals from gnome-screensaver. (...)

The FAQ provides an example dbus-monitor command:
```
dbus-monitor --session "type='signal',interface='org.gnome.ScreenSaver',member='SessionIdleChanged'"
```
Although I believe the interface and member details are outdated for Ubuntu 9.10; the proper values seem to be interface=org.freedesktop.ConsoleKit.Session and member=IdleHintChanged. (See the ConsoleKit documentation.)

When the screensaver lock is enabled, the IdleHintChanged signal is emitted after the password is entered successfully into the unlock dialogue.
The command gdmflexiserver -xnest can be used from the commandline to get back to the login screen. It works within your X session by itself, but you can use dbus-launch to execute it from, say, an SSH session:
```
DISPLAY=:0 dbus-launch gdmflexiserver -xnest
```
That "activates" the GDM login screen, without logging the current user session out, just like the "Switch User..." menu option does (at least as far as I can tell).

The trick will be to find some way to glue these two together. It seems to me that what you'd want to do is basically:

Disable the screensaver's lock;
Register a listener with DBus that listens for the IdleHintChanged signal on all sessions;
Have the listener execute the gdmflexiserver command when it detects the signal.

Step 1 is needed so you don't get the password prompt. If step 2 works properly and step 3 kicks off, you'll get the login window anytime your system comes out of the screensaver. But step 2 is what I'm not sure how to do.

Linux – How to make Shared Keys .ssh/authorized_keys and sudo work together

ssh and sudo have nothing to do with each other. Setting up an ssh authentication method isn't going to do anything for sudo. sudo isn't going to understand an ssh password.

passwd -l is intended to lock a user's account, so that he can no longer authenticate by password. That's pretty much the opposite of what you want, which is letting the user authenticate without a password.

I think what you want is the NOPASSWD option in your sudoers file.

(PS, there's no reason to be running a cd command with sudo. cd does not propagate to parent processes, so as soon as the sudo exits, you're back where you started.)

Edit: You keep saying that you want to lock the account password and want sudo to understand public/private keys. Sorry, sudo isn't going to use ssh keys. It isn't ssh. If you don't want users to be able to log in with their passwords, I think the answer is to disable ssh password authentication, not to lock the account. Then you can retain a password for the users, which they can use to sudo after they log in via ssh authorized_keys.

Best Answer

Related Solutions

Linux – How to wake from screensaver directly to the login screen in Ubuntu

Linux – How to make Shared Keys .ssh/authorized_keys and sudo work together

Related Question