Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I DO WANT:

To be able to select a guest session from the user menu when logged in to my administrator account in case someone needs to use my computer.

I DO NOT WANT

Someone to be able to turn on my computer and login to a guest session

I have heard of a method where one edits /etc/lightdm/lightdm.conf to include allow-guest=false (then restarting lightdm)

The problem with that method is that I specifically do not want to completely disable the guest account. I only want to disable access to it from the login menu while still retaining the ability to (while logged in to my admin account) start a guest session manually.

Is there such a fix? I can't seem to find one via search engine (and it's very difficult to word for a search)

EDIT: Yes. Ubuntu 12.04 LTS (Desktop), the latest release.

And it needs to be a guest account because of the way it functions. I want the ability to allow others to use a guest account I can launch easily from my main account because of how it functions (no password, and the fact that everything on it gets deleted when the session is over) without having an exposed password-free account available to anyone who turns on my computer.

Though if I could achieve this via a standard limited account it would be acceptable since I could just change the settings on most of the software to not save anything. It would have to be passwordless and accessible via the user list while I am logged in to my main account, but invisible/inaccessible from the main login screen.

Here is the code I mentioned. As you can see the structure is very similar but there are some key differences. There is no auto required pam_unix.so and the link says to add a line called auth optional pam_permit.so but I already have auth required pam_permit.so and such other little differences.

#%PAM-1.0
auth    requisite       pam_nologin.so
auth    required        pam_env.so readenv=1
auth    required        pam_env.so readenv=1 envfile=/etc/default/locale
auth    required        pam_permit.so
@include common-account
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
session required        pam_limits.so
@include common-session
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
@include common-password
share|improve this question
1  
Why does it need to be a 'guest' account? Would not an additional user or session be just as good? –  david6 Aug 4 '12 at 1:27
    
I assume this is Ubuntu 12.04. –  david6 Aug 4 '12 at 1:27
    
Yes, and I have answered your first question by editing the original post. –  George Aug 4 '12 at 3:15
    
so you want to make a 'hidden' account? –  Mateo Aug 4 '12 at 21:11
    
Yes, I suppose that would make sense. An account complete inaccessible from the main login screen and only accessible from the list of users that appears if you hit the user menu on the top right portion of the unity interface. (Having this sort of behavior for the guest account would be great, but a standard account would be fine too) –  George Aug 5 '12 at 0:13

2 Answers 2

Possible Solution: (not tested)

Based on ArchLinux::LightDM

  • leave Guest enabled
  • stop Guest from successful login, by adjusting PAM behavior.

( see Enabling Autologin, but reversing the suggested logic )

share|improve this answer
    
First I tried to find a way to add the guest account as a member of a group to no avail, so I made a standard account instead. However once I tried to edit the lightdm-autologin file the structure was similar to the one in that link but it was a bit different, and didn't have the line I needed to work with. I will edit the original post to include it in case you can spot something helpful. –  George Aug 4 '12 at 21:38

I have an open PAM-related question right now, so I can say from experience that modifying any PAM modules can quickly get very specific to the version of Ubuntu you are working with. What works for Precise, may not always work for Quantal, etc.

That said, the answer to your question probably does not require any changes to PAM modules. In fact, you almost have it.

Add this line to the bottom of /etc/lightdm/lightdm.conf

greeter-allow-guest=false

My lightdm.conf looks like this:

=====

[SeatDefaults]
greeter-session=unity-greeter
user-session=ubuntu
greeter-allow-guest=false

=====

Now restart your machine.

On 12.10, I tested that this removes Guest from the user menu, but leaves it as a manual option once logged in on another account.

Pretty sure this will work for you on 12.04 as well.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.