Enable and Disable Helpers

Documentation / Contents - CyLogin

• Overview of CyLogin
  • What It Is
  • What It Is Not
  • The Programs
  • In This Book
• Setting Up
  • What You Need
  • Build and Install
  • Enable With the Helper
  • Linux SysV and systemd
  • NetBSD rc.d
  • PAM Service File
  • Xservers and VT
  • Headless and LXC
  • Competing Display Managers
  • Check That It Works
  • Disable and Rollback
  • Common Mistakes
• Using CyLogin
  • Logging In
  • Faces
  • noiconlogin
  • Session Lock
  • Autologin and Classroom
  • After Login (Session)
  • Failsafe
• Configuration
  • Master Conf
  • Appearance
  • Session Path
  • Unsafe Knobs
  • Autologin Knobs
  • Lock Timeout
  • Classroom Sample
• Enable and Disable Helpers
  • cylogin-enable
  • Every enable Flag
  • cylogin-disable
  • Examples
• Security and PAM
  • Defaults
  • PAM Stacks
  • Empty Password Gate
  • Auth Dir and Cookies
  • Vs XDM and login
  • Lab Matrix
• Command Line
  • cylogind
  • cylogin Greeter
  • cylogin-authcheck
  • cychooser
• Keys and Shortcuts
• Files and Paths
  • System Conf
  • Runtime
  • Share Install
  • Init and PAM
• Troubleshooting
  • Greeter Never Appears
  • No Screens Found
  • PAM Failures
  • Wrong Session After Login
  • Setuid and Nobody
• Copyright

Enable and Disable Helpers

Two PATH helpers install with Blueprint (also under share/cylogin/scripts):

cylogin-enable
cylogin-disable

They are the supported way to claim or leave the console seat. Full enable refuses to run without --yes or --dry-run. Prefer dry-run on every new host.

cylogin-enable

cylogin-enable --dry-run
sudo cylogin-enable --yes

Bare --dry-run prints the full enable plan without changing the system. --yes as root runs that plan.

What --yes does:

1. chown/chmod 4755 on cylogin-authcheck (root:root or root:wheel) 2. mkdir /etc/cyanotype, /var/run/cyanotype, authdir 0711, enable-state 3. Install /etc/pam.d/cylogin if missing (Linux; skip on NetBSD) 4. Seed missing conf/Xservers/Xaccess/X* hooks; optional Xorg dummy conf 5. Install init.d or rc.d; claim default-display-manager on Linux 6. Stop/disable competing DMs 7. Start cylogind when Xorg and a seat (or dummy) exist; else warn and leave PAM/conf/init in place

Does NOT create _cylogin. Does NOT overwrite live conf/PAM/Xservers unless you pass --force-conf or --force-pam.

Every enable Flag

• -h, --help -- short usage from the script header
• -n, --dry-run -- print actions; no changes; no root required
• -y, --yes -- allow full enable (with dry-run, plan only)
• --fix-privs -- setuid authcheck + runtime dirs + nobody check
• --install-pam -- install pam.d/cylogin if missing (Linux)
• --force-pam -- replace existing pam.d/cylogin
• --seed-conf -- seed missing /etc/cyanotype files; attempt dummy conf when Xorg exists without a local seat
• --force-conf -- replace live conf/Xservers/Xaccess/dummy conf seeds
• --enable-init -- install and start SysV/rc.d path (includes DM claim)
• --prefix=PATH -- PREFIX for bin and share (default /usr/local)

Environment overrides when needed:

PREFIX=/opt/cyanotype
CYLOGIN_SHARE=/opt/cyanotype/share/cylogin
BINDIR=... CONFDIR=... AUTHDIR=... PIDDIR=... STATE_DIR=...

Staged examples (root, no full claim):

sudo cylogin-enable --fix-privs
sudo cylogin-enable --install-pam
sudo cylogin-enable --seed-conf
sudo cylogin-enable --enable-init

Note: --yes alone always means full enable. Staged flags without --yes run only those stages (still need root unless --dry-run).

cylogin-disable

cylogin-disable --dry-run
sudo cylogin-disable --yes

Stops cylogind (SysV/systemd or NetBSD rc.d). Restores /etc/X11/default-display-manager from /var/lib/cyanotype/enable-state/previous-display-manager when that file exists and is not the sentinel none. Best-effort start of the previous DM. Does not delete /etc/cyanotype or remove PAM. Does not remove rc.d/init scripts.

Examples

Preview on a twin without touching the live seat:

cylogin-enable --dry-run

Lab LXC after Blueprint install:

sudo cylogin-enable --yes

Headless LXC after installing the dummy driver:

sudo apt install xserver-xorg-video-dummy
sudo cylogin-enable --seed-conf --force-conf
sudo cylogin-enable --enable-init
# or simply: sudo cylogin-enable --yes

Replace a broken PAM sample on purpose:

sudo cylogin-enable --install-pam --force-pam

Leave conf alone, only fix setuid after a non-root unpack:

sudo cylogin-enable --fix-privs

Rollback DM claim:

sudo cylogin-disable --dry-run
sudo cylogin-disable --yes