Ubuntu, Linux Mint, and the Guest Account
I know there's not much new here, but I am amazed that Ubuntu, Linux Mint and friends ship with a Guest account present and enabled. The Guest account is surreptitiously added through a lightdm configuration file, and is not part of the standard user database. Because its not part of the standard user database, it can't be disabled through /etc/shadow, nor disable it through familiar tools such as userdel and usermod. Additionally, the damn account does not show up in distribution provided tools such as User Accounts applet. To make matters worse, grepping for guest returns 0 results because lightdm.conf does not mention one must add the following to disable the guest account (nothing is required to enable the account): allow-guest=false To add insult to injury, the Guest account is not sandboxed and user home directories lack sufficient ACLs, so the guest account is able to wander through user's home directories: guest-dojMxl@vb-mint-12-x64 ~ $ pwd /tmp/guest-dojMxl guest-dojMxl@vb-mint-12-x64 ~ $ whoami guest-dojMxl guest-dojMxl@vb-mint-12-x64 /home/jwalton $ cd /home/ guest-dojMxl@vb-mint-12-x64 /home $ ls -al total 12 drwxr-xr-x 3 rootroot4096 2012-05-05 16:29 . drwxr-xr-x 23 rootroot4096 2012-05-05 16:32 .. drwxr-xr-x 5 jwalton jwalton 4096 2012-05-05 16:35 jwalton guest-dojMxl@vb-mint-12-x64 ~ $ cd /home/jwalton/ guest-dojMxl@vb-mint-12-x64 /home/jwalton $ ls -al total 28 drwxr-xr-x 5 jwalton jwalton 4096 2012-05-05 16:35 . drwxr-xr-x 3 rootroot4096 2012-05-05 16:29 .. -rw-r--r-- 1 jwalton jwalton 220 2012-05-05 16:29 .bash_logout drwx-- 3 jwalton jwalton 4096 2012-05-05 16:35 .cache drwxr-xr-x 3 jwalton jwalton 4096 2012-05-05 16:29 .config drwxr-xr-x 4 jwalton jwalton 4096 2012-05-05 16:29 .mozilla -rw-r--r-- 1 jwalton jwalton 675 2012-05-05 16:29 .profile ... Is there any reason a KIOSK-like account is enabled by default? Do KIOSKs really dominate the desktop market to warrant the account out of the box?
Re: [Full-disclosure] Ubuntu, Linux Mint, and the Guest Account
On Sat, 2012-05-05 at 19:42 -0400, Jeffrey Walton wrote: I know there's not much new here, but I am amazed that Ubuntu, Linux Mint and friends ship with a Guest account present and enabled. The Guest account is surreptitiously added through a lightdm configuration file, and is not part of the standard user database. Because its not part of the standard user database, it can't be disabled through /etc/shadow, nor disable it through familiar tools such as userdel and usermod. Additionally, the damn account does not show up in distribution provided tools such as User Accounts applet. To make matters worse, grepping for guest returns 0 results because lightdm.conf does not mention one must add the following to disable the guest account (nothing is required to enable the account): allow-guest=false To add insult to injury, the Guest account is not sandboxed and user home directories lack sufficient ACLs, so the guest account is able to wander through user's home directories: The guest account should be confined with an AppArmor profile on Ubuntu, which prevents it from accessing other users' directories. Please file a bug if this isn't working correctly for you. Marc.
