RHEL7 gdm lets users create new accounts?

Latest response

After an everything install, it appears that gdm has greeter screen offering anyone to create an account on the host. Not good for a NIS/NFS host. I tried the enterprise login, and it failed to log me in (though NIS was already bound to the correct domain, and the user could log in at an alternate text console). Worse, it appeared that it "remembered" the password I typed in. The next try to log in (clicking the "Enterprise Login" button) presented a screen auto-filled with the same user name and appearing to have a password (though dotted-out).

This seems like rather promiscuous behaviour from a display manager.

I installed/enabled kdm (disabled gdm.service), which immediately worked.

What am I missing regarding gnome gdm? Shouldn't it behave more conservatively in an enterprise distribution?

Responses

Hi Bob,
Are you referring to the "firstboot" routine?
https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/7-Beta/html/Installation_Guide/chap-initial-setup.html

The RHEL documentation seems to indicate that the user creation screen is present when no user was created during the installation?
In previous versions, firstboot is enabled when you install the X-window groups.

It did seem like a variation on firstboot. But besides a domain, it also had user+password prompt boxes. To check, I installed kdm and:
systemctl disable gdm.service
systemctl enable kdm.service
.. then rebooted. At that point I got a user+password prompt, that directly logged in using NIS authentication, and my home directory was present. Both the gnome3 and kde-plasma desktops seemed functional (had menus of apps).

If it was firstboot, I would have expected it to still be present - unless it's tied in to gdm

I'm curious if you would have had the same outcome if you had simply rebooted after completing the user auth portion (but not added kdm and disabled gdm). I don't believe it's tied to gdm specifically. Rather it's tied to any Desktop Manager. I have to admit, I rarely build a machine to present a desktop and equally as rarely using the installer (instead of kickstart) - so, I can only assume ;-)

On a related note, trying to remove bluez (no bluetooth allowed in the facility) with yum, it would have removed gnome-bluetooth (expected) and also gdm (unexpected). It seems unusual that a display manager would require bluetooth support - it should be optional.

James - sorry to be so disjoint. You're correct in that we did not create a user during install (only root). And X-windows is enabled. As far as the beta went, we went for an initial everything install, then hand-modified to match our enterprise. We usually use kickstart + yum to configure machines to set up ntp, NIS, NFS, printing, and other infrastructure.

The strange thing was it seemed like I couldn't skip past the user creation step.