0

We've had Ubuntu on my wife's computer at home for several years now and as far as I am aware, she has always had to use her password to login.

However, a couple of days ago, she pointed out to me that after booting up her computer, she can log in simply by pressing the < enter > key at the password prompt. I checked and she is right. Interestingly, if you lock the screen, you are then forced to enter a password, you can't bypass it by pressing

This seems like a major security flaw but Googling doesn't turn up anything relevant - maybe I'm using the wrong search terms.

Perhaps also we have inadvertently changed a configuration somewhere without appreciating the consequences. However, after hunting around the Unity security settings and Googling, I can't find any way of configuring Unity to prompt for a password but allow the user to bypass it.

Oh, and for the record, yes my wife's login does have a password set and on the User Accounts GUI, "Automatic login" is OFF.

So this leads to two supplementary questions: - how do I configure her computer to require a password at the Unity login prompt? - If I can't, is this a security flaw that requires a bug report?

  • May be a bug in the lightdm greeter - the login screen. Try installing another instance of lightdm or switch to gdm. What's in your /etc/lightdm/lightdm.conf file ? – Sergiy Kolodyazhnyy Mar 31 '15 at 5:01
  • Unfortunately I'm away from home for a few days so I can't check the /etc/lightdm/lightdm.conf file until I return. Meanwhile, it would be interesting if some of you reading this could try doing what we did (ie, boot up your computer and at the GUI login prompt, just left-click with the mouse in the password box, or press the < enter > key and report your findings here. It would be good to know if this is some sort of weird configuration problem with our computer, or something more widespread. – Rob Hills Apr 1 '15 at 13:43
  • I just tried your experiment. Booted up the computer, and at the password prompt hit Enter. A few dots went in circles inside the password entry box for a second or two showing that it is working, then the words "Invalid password, please try again" showed up in red in between the user name and and the password entry box. So, I cannot reproduce the outcome of being able to log in without my password. – user68186 Apr 1 '15 at 16:49
  • OK, thanks for trying. I am pleased this appears to be an issue with my Wife's computer rather than a more global security problem. I will investigate further when we get home after Easter. – Rob Hills Apr 3 '15 at 3:03
0

Try changing password or turning on/off Automatic Login. If it wouldn't work I think you need to report a bug.

  • Hi Michael, thanks for the suggestion. I tried this (turning Automatic Login on, rebooting, turning it off and rebooting again) and it makes no difference. I can still log in to her Unity Login prompt without a password. This time around, I discovered that if you simply left-click the password field it logs you in! – Rob Hills Mar 31 '15 at 15:26
0

It doesn't do anything that you wouldn't be able to do by booting up with a live USB drive. In other words, it gets you into the file system, which you can anyway do in a number of ways. If you wanted to improve security, you'd need to encrypt the harddrive, which is an option.

There sometimes are ways to lock down the boot in the bios, but I wouldn't recommend them, and anyway, you can still generally just take the harddrive out...

Hang on. On a more careful read, are you saying you can log into your wife's account?! Not a anonymous account? What key did you say does that?

  • I agree that a live USB would give access to the computer's hard drives etc, but a functioning password system would at least deter casual snoopers. This is a home PC after all. – Rob Hills Mar 31 '15 at 15:28
  • Which key? the < enter > key (it had disappeared from my OP because I had the angle-brackets around it. I've since found that a mouse-click in the password field also logs me in! – Rob Hills Mar 31 '15 at 15:33
  • So the question is whether you're getting into a "guest user" account, or into your wife's specific account? Here's some info on guest sessions – Dr Xorile Mar 31 '15 at 21:52
  • Not sure why that question arises actually, I never mentioned a guest account! No this is the primary user login. If you have Ubuntu 14.04LTS, I suggest you try it, boot up your computer, and at the login prompt, either left-click with the mouse in the password box, or just press the < enter > key. You'll see what I'm talking about. – Rob Hills Apr 1 '15 at 13:40
  • Hi Rob. We're not trying to frustrate you. I just don't think anyone can think of a way that this could happen in any other way! – Dr Xorile Apr 3 '15 at 8:49

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.