Using CyLogin

Documentation / Contents - CyLogin

• Overview of CyLogin
  • What It Is
  • What It Is Not
  • The Programs
  • In This Book
• Setting Up
  • What You Need
  • Build and Install
  • Enable With the Helper
  • Linux SysV and systemd
  • NetBSD rc.d
  • PAM Service File
  • Xservers and VT
  • Headless and LXC
  • Competing Display Managers
  • Check That It Works
  • Disable and Rollback
  • Common Mistakes
• Using CyLogin
  • Logging In
  • Faces
  • noiconlogin
  • Session Lock
  • Autologin and Classroom
  • After Login (Session)
  • Failsafe
• Configuration
  • Master Conf
  • Appearance
  • Session Path
  • Unsafe Knobs
  • Autologin Knobs
  • Lock Timeout
  • Classroom Sample
• Enable and Disable Helpers
  • cylogin-enable
  • Every enable Flag
  • cylogin-disable
  • Examples
• Security and PAM
  • Defaults
  • PAM Stacks
  • Empty Password Gate
  • Auth Dir and Cookies
  • Vs XDM and login
  • Lab Matrix
• Command Line
  • cylogind
  • cylogin Greeter
  • cylogin-authcheck
  • cychooser
• Keys and Shortcuts
• Files and Paths
  • System Conf
  • Runtime
  • Share Install
  • Init and PAM
• Troubleshooting
  • Greeter Never Appears
  • No Screens Found
  • PAM Failures
  • Wrong Session After Login
  • Setuid and Nobody
• Copyright

Using CyLogin

This page is day-to-day greeter behaviour. Setup and helpers are in Setting Up and Enable and Disable Helpers. Conf knobs are in Configuration.

Logging In

Pick your account from the icon grid, or type the login name. A single click only fills the name. Press Enter, double-click the icon, or press Log In to commit it. If the account has a password, the Password field appears then.

Under cylogind, Log In is live authentication. Standalone (no daemon on fd 3) the greeter is a face-only picker: no authentication and no session start. That standalone mode is for demos and layout work.

Uniform failure copy: "Cannot log in to this account." Timing is padded so unknown users are not revealed by stopwatch.

Faces

Each account may have a picture in the system face directory:

PREFIX/share/cylogin/faces/<login>.rgb

SGI RGB image. A picture in the home directory wins when the daemon can stat a regular file (not a symlink):

$HOME/.icons/login.rgb
$HOME/.icons/login.icon

If neither exists, the tile shows the workstation icon. Demo mode (--demo) uses twenty fixed fantasy users with placeholder faces and does not read real accounts.

noiconlogin

If noiconlogin is on in cylogin.conf, the icon grid is replaced by the CyLogin mark. You still log in by typing your name. Useful when faces are unwanted or the seat is a typed-login kiosk.

Session Lock

After a CyScreen / cysaver hack is dismissed, the unlock face is:

cylogin-greeter --lock

Portrait tarot-card window for the real uid only. Password field focused. Closing the window does not unlock. Optional timeout:

--lock-timeout SEC
lock_timeout in /etc/cyanotype/cylogin.conf
CYLOGIN_LOCK_TIMEOUT
~/.cyanotype/cylogin.conf (user conf can win over system)

Default 120 seconds; 0 waits forever. On timeout the process exits 2 so cysaver can resume the screen hack. Authcheck verifies getuid() only on this path (you cannot unlock as someone else).

Autologin and Classroom

SLIM-style standing autologin (lab / kiosk), off by default:

auto_login on
default_user aliver

After X is ready, that user is logged in with no password prompt, every session cycle (logout returns to another free login). Root, missing homes, /etc/nologin, and expiry still refuse; only the password check is skipped. Compact form: autologin NAME. Per-display override under [display :0] is supported.

IRIX one-shot path still exists: /etc/autologin plus /etc/autologin.on (flag consumed after one fire).

Classroom desks (s1-s6, instructor-pc) ship a sample:

share/cylogin/cylogin.conf.classroom.sample

That forces session to startcyanotype.sh and auto_login as student so a leftover Slim ~/.xsession cannot steal the desktop. WARNING: physical access is a free session as that user.

After Login (Session)

Precedence:

1. cylogin.conf session=/path -- if set, that command runs as the user and bypasses Xsession entirely (classroom / kiosk). 2. Else /etc/cyanotype/Xsession (seeded from share). 3. Inside Xsession: Blueprint startcyanotype.sh by default; user ~/.xsession only if CYLOGIN_USER_XSESSION=1 or Blueprint is missing. 4. Failsafe: xterm, then /bin/sh.

So: set session= on desks that must always land in Cyanotype. Leave it unset for personal machines that still honour a chosen ~/.xsession when you opt in.

Failsafe

From the greeter, FAILSAFE (when offered) reaches a minimal session if the normal desktop path is broken. Xsession also falls back to xterm so a broken Blueprint install cannot lock someone out of the console forever. Fix the session= line or startcyanotype, then log in again.