10

I am running a single-user Ubuntu install.

When I enter the password to unlock my screen after suspend/timeout, it is the same password I use for sudo - my user password. Is there any way for me to set a different, weaker password for unlocking from sleep, so it's safe to give it to friends that, for example, are reading something on my computer and forget to wiggle the mouse without me having to give them potential root access if they decided to?

The only reason I even have a lock screen is so little siblings won't hit random keys and mess up my work when I forget and leave for a minute, so lockscreen "security" is totally a non-issue.

I am using GDM / Gnome 3.16 on Ubuntu 15.04.

I need to add that removing my login account from sudoers and using another account for sudo-related work is not a solution that I can consider.

Improve this question
13
  • If they are on it why not just disable the lock? Also, if they have physical access they can change the password.
    – Tim
    May 5, 2015 at 18:16
  • Yea, that's an option, but sometimes I forget to it's already asleep and I want them to check something. Also, the only reason I use a lockscreen is because otherwise little kids will mess up everything.
    – Robin
    May 5, 2015 at 18:18
  • Hmm good points. Okay, you could disable your account being root, then add a root password to the root account? askubuntu.com/a/490747/186134
    – Tim
    May 5, 2015 at 18:19
  • @Tim A few other places said something about PAM's per-app configuration ability, but didn't give details. After fiddling, I haven't gotten anywhere. Do you know anything about PAM?
    – Robin
    May 6, 2015 at 3:57
  • 3
    check this link . It deals with exactly your issue and has an accepted solution.
    – Amit
    Oct 9, 2015 at 20:22

1 Answer 1

Reset to default
1

Gnome/GDM (through PAM) normally use your user account info defined in /etc/passwd and /etc/shadow.

You are (I am) correct that the configuration files in /etc/pam.d/* are how the configuration is done, but first, you need to create a new passwd file with your desired lock screen password. This great answer by @AaronD (please do upvote him) has details on how to do that using htpasswd editor.

Once you have created that alternative passwords file, save it to /etc/gdm.passwd (or somewhere) and add this line to the beginning of /etc/pam.d/gdm-password:

auth     required  pam_pwdfile.so pwdfile /etc/gdm.passwd

where /etc/gdm.passwd is the path where you saved the passwd file. And comment out the system-local-login line that follows. This switches the required authentication from pulling from normal local account to your new configuration.

No restarting or anything should be required, just save that file and Super+L to test it out!

This is just a compliation of the procedure that worked out for me. All credit to @AaronD and @Amit.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .