Bug 152161 - KDM allows passwordless login when using "Start New Session"
Summary: KDM allows passwordless login when using "Start New Session"
Status: RESOLVED NOT A BUG
Alias: None
Product: kdm
Classification: Miscellaneous
Component: general (show other bugs)
Version: unspecified
Platform: Ubuntu Linux
: NOR normal
Target Milestone: ---
Assignee: kdm bugs tracker
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2007-11-11 05:35 UTC by monstermunch
Modified: 2008-05-19 17:30 UTC (History)
0 users

See Also:
Latest Commit:
Version Fixed In:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description monstermunch 2007-11-11 05:35:41 UTC
Version:            (using KDE KDE 3.5.8)
Installed from:    Ubuntu Packages

Instructions:
 Use KDM as your login manager and login to KDE.
 Open a terminal.
 Type "sudo adduser bug" and fill in the password to create a new user called "bug" (or just use an account you already have).
 Goto K-menu->Switch User->Start New Session.
 The KDM login manager screen should appear. Login as "bug" with your password.
 Logout as bug and switch back to your first session (should happen automatically).
 Goto K-menu->Switch User->Start New Session.

What happens:
 You will be automatically logged into KDE as "bug" without being asked if you wanted to or being asked for the password.

What I expected:
 To be presented with the KDM login screen.

If you wait a couple of minutes before doing the final instruction, the expected behaviour happens. I use Kubuntu Gutsy and my KDM settings say to automatically log in on X server crash and auto-login my main (not "bug") user. This seems like a serious security problem to me in an environment where people share machines as it would be easy to let someone login as your new session, wait for them to log out and then login to their account with no password.

I reported this on ubuntu's launchpad but have had no real response to what seems like a huge deal to me. This bug was in Ubuntu Edgy, was not in Feisty but is back again in Gutsy.
Comment 1 Oswald Buddenhagen 2007-11-11 09:06:44 UTC
do you have the AutoReLogin option enabled in kdmrc?
Comment 2 monstermunch 2007-11-12 00:42:16 UTC
Yes, I do. Is this a bug or expected behaviour because of this? My full kdmrc file is below:

[General]
ConfigVersion=2.3
ConsoleTTYs=tty1,tty2,tty3,tty4,tty5,tty6
PidFile=/var/run/kdm.pid
ReserveServers=:1,:2,:3
ServerVTs=-7
StaticServers=:0

[Shutdown]
BootManager=Grub
HaltCmd=/sbin/poweroff
RebootCmd=/sbin/reboot

[X-*-Core]
AllowNullPasswd=false
AllowRootLogin=false
AllowShutdown=Root
AutoReLogin=true
ClientLogFile=.xsession-errors-%s
Reset=/etc/kde3/kdm/Xreset
Session=/etc/kde3/kdm/Xsession
Setup=/etc/kde3/kdm/Xsetup
Startup=/etc/kde3/kdm/Xstartup

[X-*-Greeter]
AntiAliasing=true
ColorScheme=
EchoMode=OneStar
FaceSource=AdminOnly
FailFont=Sans Serif,10,-1,5,75,0,0,0,0,0
GUIStyle=
GreetFont=Sans Serif,22,-1,5,50,0,0,0,0,0
GreetString=Welcome to Kubuntu at %n
GreeterPos=50,50
HiddenUsers=
Language=en_GB
LogoArea=Logo
LogoPixmap=/usr/share/apps/kdm/pics/kdelogo.png
MaxShowUID=29999
MinShowUID=1000
Preloader=/usr/bin/preloadkde
SelectedUsers=
ShowUsers=NotHidden
SortUsers=true
StdFont=Sans Serif,10,-1,5,50,0,0,0,0,0
Theme=@@@ToBeReplacedByDesktopBase@@@
UseBackground=true
UserCompletion=false
UserList=false

[X-:*-Core]
AllowNullPasswd=true
AllowShutdown=All
NoPassEnable=false
NoPassUsers=
ServerArgsLocal=-nolisten tcp
ServerCmd=/usr/bin/X -br

[X-:*-Greeter]
AllowClose=true
DefaultUser=seanw
FocusPasswd=true
LoginMode=DefaultLocal
PreselectUser=Default

[X-:0-Core]
AutoLoginAgain=false
AutoLoginDelay=0
AutoLoginEnable=true
AutoLoginLocked=false
AutoLoginUser=monstermunch
ClientLogFile=.xsession-errors

[Xdmcp]
Enable=false
Willing=/etc/kde3/kdm/Xwilling
Comment 3 Oswald Buddenhagen 2007-11-12 00:54:41 UTC
please attach files of any significant size instead of pasting them.

well, no, it's not really expected. the "couple minutes" should be 15 seconds, though.
i need the daemon.* syslog from kdm -debug 7. further details can be found in the kdm README.
Comment 4 Oswald Buddenhagen 2007-11-15 16:40:03 UTC
works for me.
i actually think what happens is completely in line with expectations ... your X server is simply crashing at the end of the session (you'll see this in /var/log/kdm.log). you might try the TerminateServer option to work around it. or just unset AutoReLogin ...
reopen and followup on comment #3 if my guess is wrong.