Configuration

Documentation / Contents - CyLogin

• Overview of CyLogin
  • What It Is
  • What It Is Not
  • The Programs
  • In This Book
• Setting Up
  • What You Need
  • Build and Install
  • Enable With the Helper
  • Linux SysV and systemd
  • NetBSD rc.d
  • PAM Service File
  • Xservers and VT
  • Headless and LXC
  • Competing Display Managers
  • Check That It Works
  • Disable and Rollback
  • Common Mistakes
• Using CyLogin
  • Logging In
  • Faces
  • noiconlogin
  • Session Lock
  • Autologin and Classroom
  • After Login (Session)
  • Failsafe
• Configuration
  • Master Conf
  • Appearance
  • Session Path
  • Unsafe Knobs
  • Autologin Knobs
  • Lock Timeout
  • Classroom Sample
• Enable and Disable Helpers
  • cylogin-enable
  • Every enable Flag
  • cylogin-disable
  • Examples
• Security and PAM
  • Defaults
  • PAM Stacks
  • Empty Password Gate
  • Auth Dir and Cookies
  • Vs XDM and login
  • Lab Matrix
• Command Line
  • cylogind
  • cylogin Greeter
  • cylogin-authcheck
  • cychooser
• Keys and Shortcuts
• Files and Paths
  • System Conf
  • Runtime
  • Share Install
  • Init and PAM
• Troubleshooting
  • Greeter Never Appears
  • No Screens Found
  • PAM Failures
  • Wrong Session After Login
  • Setuid and Nobody
• Copyright

Configuration

Master file:

/etc/cyanotype/cylogin.conf

House format: one key value per line, # comments, booleans on/off (also true/false, yes/no, 1/0 where accepted). Sample:

PREFIX/share/cylogin/cylogin.conf.sample

cylogin-enable --seed-conf copies the sample only when the live file is missing. --force-conf replaces it on purpose.

Master Conf

Path keys (defaults match G0.4a; usually leave alone):

• servers_file -- Xservers path (default /etc/cyanotype/Xservers)
• auth_dir -- cookie dir (default /var/lib/cyanotype/authdir)
• script_dir -- Xsetup/Xstartup/Xsession/Xreset directory
• greeter -- path to cylogin-greeter
• greeter_user -- unprivileged greeter account (default nobody)

Appearance and scheme:

• greeter_mode large (layout)
• faces on / off
• noiconlogin on / off
• greeter_scheme -- standalone colour scheme path or asset name (default Space and Planetary under share when empty)

Appearance

greeter_mode large
faces on
noiconlogin off

faces off or noiconlogin on changes how accounts are presented; typed login still works. --canonical on the greeter CLI is measured clogin geometry (look/manners only). It does NOT enable unsafe knobs.

Session Path

# session /usr/local/bin/startcyanotype.sh

When set, cylogind runs that command as the user after auth and skips Xsession. Classroom/kiosk should set this so leftover Slim/icewm ~/.xsession cannot win. When unset, script_dir/Xsession runs; see Using CyLogin.

Environment for optional user .xsession inside Xsession:

CYLOGIN_USER_XSESSION=1

Unsafe Knobs

All off by default. Documented in src/cylogin/docs/security.md.

allow_root_login off
allow_null_passwd off
show_devnull_shell off

• allow_root_login on -- root may appear and authenticate at the greeter.
• allow_null_passwd on -- empty password hash accepts empty typed password.
• show_devnull_shell on -- picker shows /dev/null-shell accounts again.

Even when PAM would allow root or nullok, CyLogin policy applies after PAM. Empty typed password is refused unless allow_null_passwd is on (closes RHEL system-auth nullok walk-in). See Security and PAM.

Autologin Knobs

auto_login off
# default_user aliver
# autologin_user aliver

Compact: autologin NAME or autologin off. Per-display block:

[display :0]
autologin aliver

Lab twins often use auto_login on + default_user aliver. Physical access equals that session. Keep off on machines that face strangers.

Lock Timeout

lock_timeout 120

Seconds to wait for a password under --lock. 0 = forever. Also --lock-timeout SEC and CYLOGIN_LOCK_TIMEOUT. User file ~/.cyanotype/cylogin.conf may override system for lock_timeout.

Classroom Sample

PREFIX/share/cylogin/cylogin.conf.classroom.sample

Copy to /etc/cyanotype/cylogin.conf on student desks when you want:

• session forced to startcyanotype.sh
• auto_login on + default_user student
• unsafe knobs left off

Requires a student account and startcyanotype on PATH.