To be able to select a guest session from the user menu when logged in to my administrator account in case someone needs to use my computer.


Someone to be able to turn on my computer and login to a guest session

I have heard of a method where one edits /etc/lightdm/lightdm.conf to include allow-guest=false (then restarting lightdm)

The problem with that method is that I specifically do not want to completely disable the guest account. I only want to disable access to it from the login menu while still retaining the ability to (while logged in to my admin account) start a guest session manually.

Is there such a fix? I can't seem to find one via search engine (and it's very difficult to word for a search)

EDIT: Yes. Ubuntu 12.04 LTS (Desktop), the latest release.

And it needs to be a guest account because of the way it functions. I want the ability to allow others to use a guest account I can launch easily from my main account because of how it functions (no password, and the fact that everything on it gets deleted when the session is over) without having an exposed password-free account available to anyone who turns on my computer.

Though if I could achieve this via a standard limited account it would be acceptable since I could just change the settings on most of the software to not save anything. It would have to be passwordless and accessible via the user list while I am logged in to my main account, but invisible/inaccessible from the main login screen.

Here is the code I mentioned. As you can see the structure is very similar but there are some key differences. There is no auto required pam_unix.so and the link says to add a line called auth optional pam_permit.so but I already have auth required pam_permit.so and such other little differences.

auth    requisite       pam_nologin.so
auth    required        pam_env.so readenv=1
auth    required        pam_env.so readenv=1 envfile=/etc/default/locale
auth    required        pam_permit.so
@include common-account
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close
session required        pam_limits.so
@include common-session
session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open
@include common-password
  • 1
    Why does it need to be a 'guest' account? Would not an additional user or session be just as good?
    – david6
    Aug 4, 2012 at 1:27
  • I assume this is Ubuntu 12.04.
    – david6
    Aug 4, 2012 at 1:27
  • Yes, and I have answered your first question by editing the original post.
    – George
    Aug 4, 2012 at 3:15
  • so you want to make a 'hidden' account?
    – Mateo
    Aug 4, 2012 at 21:11
  • Yes, I suppose that would make sense. An account complete inaccessible from the main login screen and only accessible from the list of users that appears if you hit the user menu on the top right portion of the unity interface. (Having this sort of behavior for the guest account would be great, but a standard account would be fine too)
    – George
    Aug 5, 2012 at 0:13

2 Answers 2


I have an open PAM-related question right now, so I can say from experience that modifying any PAM modules can quickly get very specific to the version of Ubuntu you are working with. What works for Precise, may not always work for Quantal, etc.

That said, the answer to your question probably does not require any changes to PAM modules. In fact, you almost have it.

Add this line to the bottom of /etc/lightdm/lightdm.conf


My lightdm.conf looks like this:


Now restart your machine.

On 12.10, I tested that this removes Guest from the user menu, but leaves it as a manual option once logged in on another account.

Pretty sure this will work for you on 12.04 as well.


Possible Solution: (not tested)

Based on ArchLinux::LightDM

  • leave Guest enabled
  • stop Guest from successful login, by adjusting PAM behavior.

( see Enabling Autologin, but reversing the suggested logic )

  • First I tried to find a way to add the guest account as a member of a group to no avail, so I made a standard account instead. However once I tried to edit the lightdm-autologin file the structure was similar to the one in that link but it was a bit different, and didn't have the line I needed to work with. I will edit the original post to include it in case you can spot something helpful.
    – George
    Aug 4, 2012 at 21:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .