9

This question already has an answer here:

I am running a single-user Ubuntu install.

When I enter the password to unlock my screen after suspend/timeout, it is the same password I use for sudo - my user password. Is there any way for me to set a different, weaker password for unlocking from sleep, so it's safe to give it to friends that, for example, are reading something on my computer and forget to wiggle the mouse without me having to give them potential root access if they decided to?

The only reason I even have a lock screen is so little siblings won't hit random keys and mess up my work when I forget and leave for a minute, so lockscreen "security" is totally a non-issue.

I am using GDM / Gnome 3.16 on Ubuntu 15.04.

I need to add that removing my login account from sudoers and using another account for sudo-related work is not a solution that I can consider.

marked as duplicate by fossfreedom Oct 12 '15 at 8:11

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • If they are on it why not just disable the lock? Also, if they have physical access they can change the password. – Tim May 5 '15 at 18:16
  • Yea, that's an option, but sometimes I forget to it's already asleep and I want them to check something. Also, the only reason I use a lockscreen is because otherwise little kids will mess up everything. – Robbie Wxyz May 5 '15 at 18:18
  • Hmm good points. Okay, you could disable your account being root, then add a root password to the root account? askubuntu.com/a/490747/186134 – Tim May 5 '15 at 18:19
  • @Tim A few other places said something about PAM's per-app configuration ability, but didn't give details. After fiddling, I haven't gotten anywhere. Do you know anything about PAM? – Robbie Wxyz May 6 '15 at 3:57
  • 3
    check this link . It deals with exactly your issue and has an accepted solution. – Amit Oct 9 '15 at 20:22
1

Gnome/GDM (through PAM) normally use your user account info defined in /etc/passwd and /etc/shadow.

You are (I am) correct that the configuration files in /etc/pam.d/* are how the configuration is done, but first, you need to create a new passwd file with your desired lock screen password. This great answer by @AaronD (please do upvote him) has details on how to do that using htpasswd editor.

Once you have created that alternative passwords file, save it to /etc/gdm.passwd (or somewhere) and add this line to the beginning of /etc/pam.d/gdm-password:

auth     required  pam_pwdfile.so pwdfile /etc/gdm.passwd

where /etc/gdm.passwd is the path where you saved the passwd file. And comment out the system-local-login line that follows. This switches the required authentication from pulling from normal local account to your new configuration.

No restarting or anything should be required, just save that file and Super+L to test it out!


This is just a compliation of the procedure that worked out for me. All credit to @AaronD and @Amit.

Not the answer you're looking for? Browse other questions tagged or ask your own question.