# Manual de referencia del Gestor pantallas de Gnome

Manual de referencia del Gnome Display Manager (GDM).

Martin
K.
Petersen

    mkp@mkp.net

George
Lebl

    jirka@5z.com

Brian
Cameron

    Brian.Cameron@Sun.COM

Bill
Haneman

    Bill.Haneman@Sun.COM

1998
1999
Martin K. Petersen
2001
2003
2004
George Lebl
2003
Red Hat, Inc.
2003
2004
Sun Microsystems, Inc.
2003, 2005.
Francisco Javier F. Serrador (serrador@cvs.gnome.org)

Se concede permiso para copiar, distribuir o modificar este documento según las condiciones de la GNU Free Documentation License (GFDL), Versión 1.1 o cualquier versión posterior publicada por la Free Software Foundation sin Secciones invariantes, Textos de portada y Textos de contraportada. Encontrará una copia de la GFDL en este enlace o en el archivo COPYING-DOCS distribuido con este manual.

Este manual forma parte de una colección de documentos de GNOME distribuidos según la GFDL. Si desea distribuir este manual de forma independiente de la colección, puede hacerlo agregando una copia de la licencia al documento, según se describe en la sección 6 de la misma.

Muchos de los nombres utilizados por las empresas para distinguir sus productos y servicios se consideran marcas comerciales. Cuando estos nombres aparezcan en la documentación de GNOME, y siempre que se haya informado a los miembros del Proyecto de documentación de GNOME de dichas marcas comerciales, los nombres aparecerán en mayúsculas o con las iniciales en mayúsculas.

ESTE DOCUMENTO Y LAS VERSIONES MODIFICADAS DEL MISMO SE OFRECEN SEGÚN LAS CONDICIONES ESTABLECIDAS EN LA LICENCIA DE DOCUMENTACIÓN LIBRE DE GNU (GFDL) Y TENIENDO EN CUENTA QUE:

1. EL DOCUMENTO SE ENTREGA "TAL CUAL", SIN GARANTÍA DE NINGÚN TIPO, NI EXPLÍCITA NI IMPLÍCITA INCLUYENDO, SIN LIMITACIÓN, GARANTÍA DE QUE EL DOCUMENTO O VERSIÓN MODIFICADA DE ÉSTE CAREZCA DE DEFECTOS EN EL MOMENTO DE SU VENTA, SEA ADECUADO A UN FIN CONCRETO O INCUMPLA ALGUNA NORMATIVA. TODO EL RIESGO RELATIVO A LA CALIDAD, PRECISIÓN Y UTILIDAD DEL DOCUMENTO O SU VERSIÓN MODIFICADA RECAE EN USTED. SI CUALQUIER DOCUMENTO O VERSIÓN MODIFICADA DE AQUÉL RESULTARA DEFECTUOSO EN CUALQUIER ASPECTO, USTED (Y NO EL REDACTOR INICIAL, AUTOR O AUTOR DE APORTACIONES) ASUMIRÁ LOS COSTES DE TODA REPARACIÓN, MANTENIMIENTO O CORRECCIÓN NECESARIOS. ESTA EXENCIÓN DE RESPONSABILIDAD SOBRE LA GARANTÍA ES UNA PARTE ESENCIAL DE ESTA LICENCIA. NO SE AUTORIZA EL USO DE NINGÚN DOCUMENTO NI VERSIÓN MODIFICADA DE ÉSTE POR EL PRESENTE, SALVO DENTRO DEL CUMPLIMIENTO DE LA EXENCIÓN DE RESPONSABILIDAD;Y

2. EN NINGUNA CIRCUNSTANCIA NI BAJO NINGUNA TEORÍA LEGAL, SEA POR ERROR (INCLUYENDO NEGLIGENCIA) CONTRATO O DOCUMENTO DE OTRO TIPO, EL AUTOR, EL ESCRITOR INICIAL, EL AUTOR DE APORTACIONES NI NINGÚN DISTRIBUIDOR DEL DOCUMENTO O VERSIÓN MODIFICADA DEL DOCUMENTO, NI NINGÚN PROVEEDOR DE NINGUNA DE ESAS PARTES, SERÁ RESPONSABLE ANTE NINGUNA PERSONA POR NINGÚN DAÑO DIRECTO, INDIRECTO, ESPECIAL, INCIDENTAL O DERIVADO DE NINGÚN TIPO, INCLUYENDO, SIN LIMITACIÓN DAÑOS POR PÉRDIDA DE FONDO DE COMERCIO, PARO TÉCNICO, FALLO INFORMÁTICO O AVERÍA O CUALQUIER OTRO POSIBLE DAÑO O AVERÍA DERIVADO O RELACIONADO CON EL USO DEL DOCUMENTO O SUS VERSIONES MODIFICADAS, AUNQUE DICHA PARTE HAYA SIDO INFORMADA DE LA POSIBILIDAD DE QUE SE PRODUJESEN ESOS DAÑOS.

This manual describes version 2.13.0.5 of the GNOME Display Manager. It was last updated on 01/15/2006.

## Términos y convenciones usados en este manual

This manual describes version 2.13.0.5 of the GNOME Display Manager. It was last updated on 01/15/2006.

Selector- Un programa usado para seleccionar un host remoto para gestionar una pantalla remotamente en la pantalla local (`gdmchooser`).

Configurador - La aplicación de configuración (`gdmsetup`).

GDM - Gestor de pantallas de Gnome. Se usa para describir el paquete de software como un todo. algunas veces también se refiere a él como GDM2.

dgm - El demonio del gestor de pantallas (`gdm`).

Interfaz de entrada - La venta de de entrada gráfica (`gdmlogin` o `gdmgreeter`).

Interfaz GTK+ - La ventana de entrada estándar (`gdmlogin`).

PAM - Mecanismo de autenticación enchufable

Interfaz con temas - La ventana de entrada con temas intercambiables ( `gdmgreeter`).

XDMCP - X Display Manage Protocol

Las rutas que comienzan con una palabra entre los símbolos < y > son relativas al prefijo de instalación. Ej: `<share>/pixmaps/` se refiere a `/usr/share/pixmaps` si GDM se ha configurado con `--prefix=/usr`. Normalmente también denota que GDM está instalado con `--sysconfigdir=/etc/X11`, que quiere decir que cualquier ruta a la que se refiera como `<etc>/gdm/PreSession` usualmente significa `<etc/X11>/gdm/PreSession`. note que para interoperatibilidad se recomienda que use un --prefix de `/usr` y un directorio de configuración del sistema (--sysconfdir) `/etc/X11`.

## Vista general

### Introducción

GDM es un reemplazo de XDM, el gestor de pantallas de X, a diferencia de sus competidores, (X3DM, KDM, WDM), GDM se escribió desde cero y no contiene nada de código de XDM /X Consortium.

Para más información acerca de GDM, vea el sitio web del proyecto GDM. Por favor envíe cualquier informe de fallos o solicitud de mejoras a la categoría «gdm» en bugzilla.gnome.org.

### El demonio GDM

El demonio GDM responsable de gestionar las pantallas en el sistema. Esto incluye la autenticación de usuarios, iniciar la sesión del usuario, y terminal la sesión del usuario. GDM es configurable y las formas en que puede ser configurado se describen en la sección «Configurar GDM» de este documento. Los scrpts de `Init`, `PostLogin`, `PreSession`, y `PostSession` discutidos abajo se discuten en esta sección de «Configurar GDM».

El demonio GDM soporta un protocolo de socket de dominio UNIX que puede usarse para controlar aspectos de su comportamiento y para solicitarle información. Este protocolo se describe en la sección «Controlar GDM» de este documento.

A GDM se le puede pedir que gestione una pantalla de varias formas. Las pantallas locales se gestionan siempre cuando GDM se inicia y serán reiniciadas cuando la sesión de un usuario termine. Las pantallas pueden además solicitarse por medio de XDMCP y las pantallas flexibles pueden solicitarse ejecutando el comando `gdmflexiserver`, y dichas pantallas no serán reiniciadas al salir de la sesión. Estos tipos de pantalla se tratan en la siguiente sección.

Cuando el demonio GDM se le pude que gestione una pantalla, bifurcará un proceso servidor de X, después ejecutará el script `Init` como usuario root, e iniciará el diálogo del GUI para la entrada como un proceso esclavo en la pantalla. GDM puede configurarse para usar cualquiera de los `gdmgreeter` (el predeterminado) o `gdmlogin` como el programa de diálogo del GUI. El programa `gdmlogin` soporta accesibilidad mientras que el programa `gdmgreeter` soporta mayor temabilidad. El diálogo del GUI se ejecuta como un usuario/grupo nsin privilegiosque se describe en la sección «Seguridad» más abajo. El diálogo del GUI se comunica con el demonio por medio un protocolo de sockets y mediante la entrada/salida estándar. El esclavo, por ejemplo pasa la información del usuario y contraseña al demonio GDM por medio de la entrada/salida estándar así que el demonio puede manipular la autenticación actual.

The login GUI dialog screen allows the user to select which session they wish to start and which language they wish to use. Sessions are defined by files that end in the .desktop extension and more information about these files can be found in the "Configuration" section. The user enters their name and password and if these successfully authenticate, GDM will start the requested session for the user. It is possible to configure GDM to avoid the authentication process by turning on the Automatic or Timed Login features in the GDM configuration. The login GUI can also be configured to provide additional features to the user, such as the Face Browser; the ability to halt, restart, or suspend the system; and/or edit the login configuration (after entering the root password).

GDM, by default, will use Pluggable Authentication Modules (PAM) for authentication, but can also support regular crypt and shadow passwords on legacy systems. After authenticating a user, the daemon runs the `PostLogin` script as root, and forks a slave process to start the requested session. This slave process runs the `PreSession` script as root, sets up the users environment, and starts the requested session. GDM keeps track of the user's default session and language in the user's `~/.dmrc` and will use these defaults if the user did not pick a session or language in the login GUI. On Solaris, GDM (since version 2.8.0.3) uses the SDTLOGIN interface after user authentication to tell the X server to be restarted as the user instead of as root for added security. When the users session exits, the GDM daemon will run the `PostSession` script as root.

### Tipos de pantallas diferentes

GDM supports three different display types: static (local) displays, flexible (on-demand) displays, and XDMCP (remote) displays. The "X Server Definitions" and the "Local Static X Display Configuration" subsections of the "Configuration" section explains how these various types of displays are defined in the GDM configuration file.

Las pantallas locales estáticas siempre se inician por el demonio, y cuando mueren o son matadas, se reinician. GDM puede además gestionar pantallas que en las cuales él no gestione la entrada, así que GDM puede usarse para soportar terminales X.

Flexible, or on demand displays, are started via the socket protocol with the `gdmflexiserver` command. This feature is only available to users logged in on the console and will display a new login screen. If a flexible display has previously been started on the console, running `gdmflexiserver` again will display a menu allowing users to switch back to a previous session or start a new flexible session. The `gdmflexiserver` locks the current session before starting a new flexible display, so the user's password must be entered before returning to an existing session. The `gdmflexiserver` command can also be used to launch nested `Xnest` display. These are launched in a window in the user's current session. Nested displays can be started even if not logged into the console and are started by running the `gdmflexiserver -n` command. Flexible displays are not restarted when the user session ends. Flexbile displays require virtual terminal (VT) support in the kernel, and will not be available if not supported (such as on Solaris). Nested displays require that the X server supports Xnest.

The last display type is the XDMCP remote displays which are described in the next section. Remote hosts can connect to GDM and present the login screen if this is enabled. Some things are different for remote sessions. For example, the Actions menu which allows you to shut down, restart, suspend, or configure GDM are not shown.

### XDMCP

The GDM daemon can be configured to listen for and manage X Display Manage Protocol (XDMCP) requests from remote displays. By default XDMCP support is turned off, but can be enabled if desired. If GDM is built with TCP Wrapper support, then the daemon will only grant access to hosts specified in the GDM service section in the TCP Wrappers configuration file.

GDM includes several measures making it more resistant to denial of service attacks on the XDMCP service. A lot of the protocol parameters, handshaking timeouts etc. can be fine tuned. The defaults should work for most systems, however. Do not change them unless you know what you are doing.

GDM escucha en el puerto UDP 177 y responderá a las peticiones QUERY y BROADCAST_QUERY enviando un paquete WILLING al originador.

GDM también puede configuarse para confiar en solicitudes INDIRECT y presentar un selector de equipos al display remoto. GDM recordará la selección del usuario y reenviará las peticiones subsiguiente al gestor seleccionado. GDM también soporta una extensión al protocolo que hará que se olvide de la redirección una vez que la conexión del usuario tiene éxito. Esta extensión está soportada sólo si ambos demonios son GDM. Es transparente y será ignorada por XDM u otros demonios que implementan XDMCP.

Refer to the "Security" section for information about security concerns when using XDMCP.

### El interfaz GTK+

El interfaz GTK+ es el interfaz gráfico de usuario que se presenta al usuario. El interfaz contiene un menú en la parte superior, un visor de rostros opcional, un logo opcional y un widget para entrada de texto.

El campo de entrada de texto se usa para introducir nombres de usuario, contraseñas, etc. `gdmlogin` está controlado por un demonio por debajo que es básicamente sin estado. El demonio controla el interfaz a través de un protocolo simple donde puede predir al interfaz una cadena de texto con eco activado o desactivado. Similarmente, el demonio puede cambiar la etiqueta sobre la entrada de texto para corresponder con el valor que el sistema de autenticación quiere que el usuario introduzca.

The menu bar in the top of the greeter enables the user to select the requested session type/desktop environment, select an appropriate locale/language, halt/restart/suspend the computer, configure GDM (given the user knows the root password), change the GTK+ theme, or start an XDMCP chooser.

El interfaz de entrada puede mostrar opcionalmente un logotipo en la ventana de entrada. La imagen debe estar en un formato legible por la biblioteca gdk-pixbuf (GIF, JPG, PNG, TIFF, XPM y posiblemente otros), y debe tener permiso de lectura para el usuario de GDM. Vea la opción `Logotipo` en la sección de referencia inferior para los detalles.

### El interfaz con temas

The Themed Greeter is a greeter interface that takes up the whole screen and is very themable. Themes can be selected and new themes can be installed by the configuration application or by setting the `GraphicalTheme` configuration key. The Themed Greeter is much like the GTK+ Greeter in that it is controlled by the underlying daeon, is stateless, and is controlled by the daemon using the same simple protocol.

The look and feel of this greeter is really controlled by the theme and so the user interface elements that are present may be different. The only thing that must always be present is the text entry field as described above in the GTK+ Greeter. The theme can include buttons that allow the user to select an appropriate locale/language, halt/restart/suspend the computer, configure GDM (given the user knows the root password), or start an XDMCP chooser.

Puede obtener siempre un menú de las acciones disponibles pulsando la tecla F10. Esto puede ser útil si el tema no proporciona ciertos botones cuando realmente quiere hacer alguna acción.

### El visor de rostros de GDM

GDM soporta un visor de rostros que mostrará una lista de usuarios que pueden entrar y un icono para cada usuario. Esta característica puede usarse con el interfaz GTK+ si la opción de configuración `Examinador` está establecida a "true". Esta característica puede usarse con el Interfaz con Temas si usa un tema de GDM que incluya un tipo de elemento "userlist", tal como "happygnome-list"

Por omisión, el visor de rostros está desactivado debido a que revelar nombres de usuario en la pantalla de entrada no es apropiado en muchos sistemas por razones de seguridad y debido a que GDM requiere alguna configuración para especificar qué usuarios deberían ser visibles. La configuración puede hacerse en la solapa «Usuarios» en `gdmsetup`. Esta característica es más práctica de usar en un sistema con un número pequeño de usuarios.

Los iconos usados por GDM pueden instalarse globalmente por el administrador del sistema o pueden ser colocados en los directorios personales de los usuarios.. Si se instalan globalmente deberían estar en el directorio `<share>/pixmaps/faces/` (aunque esto puede configurarse con la opción `GlobalFaceDir`) y el nombre del archivo debería ser el nombre del usuario, opcionalmente con un `.png` agregado. Los iconos de caras colocados en el directorio global de caras deben ser leíbles por el usuario GDM. Sin embargo, el demonio, proximiza las fotografías de los usuarios al interfaz y debido a esto no tienen que ser leíbles por el usuario GDM sino por el root.

Los usuarios pueden ejecutar el comando `gdmphotosetup` para configurar la imagen a usar para su id de usuario. Este programa escala apropiadamente el archivo si es más grande que las opciones de configuración `MaxIconWidth` o `MaxIconHeight` y coloca al icono en un archivo llamado `~/.face`. Aunque `gdmphotosetup` escala las imágenes del usuario automáticamente, esto no garantiza que esas imágenes de usuario estén escaladas de forma adecuada así que un usuario puede crear su archivo `~/.face` a mano.

GDM primero buscará la imagen de la cara del usuario en `~/.face`. Si no la encuentra, intentará con `~/.face.icon`. Si aún no la encuentra, usará el valor definido para "face/picture=" en el archivo `~/.gnome2/gdm`. Por último intentará con `~/.gnome2/photo` y `~/.gnome/photo` los cuales están obsoletos y se soportan por compatibilidad hacia atrás.

Si un usuario no tiene una imagen de rostro definida, GDM usará el icono "stock_person" definido en el tema GTK+ actual. Si dicha imagen no está definida, entonces usará la imagen especificada en la opción de configuración `DefaultFace` como resguardo, normalmente /usr/share/pixmaps/nobody.png.

Note que cargar y escalar los iconos de rostros situados en los directorios personales de los usuarios puede ser una tarea que consuma mucho tiempo. Debido a que no es práctico cargar imágenes sobre NIS o NFS, GDM no intenta cargar imágenes de rostros desde directorios personales remotos. Además, GDM parará de cargar imágenes de rostros después de 5 segundos de actividad y sólo mostrará los usuarios cuyas imágenes haya obtenido hasta entonces. La opción `Include` de `gdm.conf` puede usarse para especificar un conjunto de usuarios que deberían aparecer en el visor de rostros. Mientras los usuarios a incluir tengan un tamaño razonable, no debería haber ningún problema con GDM siendo incapaz de acceder a las imágenes de rostros. Para evitar estos problemas, se recomienda situar las imágenes de rostros en el directorio especificado por la opción de configuración `GlobalFaceDir`.

To control the users who get displayed in the face browser, there are a number of configuration options that can be used. If the `IncludeAll` option is set to true, then the password file will be scanned and all users will be displayed. If `IncludeAll` option is set to false, then the `Include` option should contain a list of users separated by commas. Only the users specified will be displayed. Any user listed in the `Exclude` option and users whose UID's is lower than `MinimalUID` will be filtered out regardless of the `IncludeAll` setting. `IncludeAll` is not is not recommended for systems where the passwords are loaded over a network (such as when NIS is used), since it can be very slow to load more than a small number of users over the network..

When the browser is turned on, valid usernames on the computer are inherently exposed to a potential intruder. This may be a bad idea if you don't know who can get to a login screen. This is especially true if you run XDMCP (turned off by default).

### Registro de actividad

GDM por sí mismo usará syslog para registrar los errores o el estado. También puede registrar información de depuración, que puede ser útil para encontrar problemas si GDM no funciona apropiadamente. Esto puede activarse en el archivo de configuración.

La salida de varios servidores X está almacenada en el directorio de registros de GDM, el cual es configurable, pero normalmente es `/var/log/gdm/`. La salida desde la sesión puede encontrarse en un archivo llamado `<display>.log`. Cuatro archivos más antiguos se almacenan también con `.1` a `.4` anexado. Éstos se rotarán a medida que se inicien nuevas sesiones en esa pantalla. Puede usar estos registros para ver que decía el servidor X cuando arrancaba.

La salida de la sesión de usuario está redirigida a `~/.xsession-errors` incluso antes de se inicie el script `PreSession`. Así que no es realmente necesario redirigir esto otra vez en el script de configuración de la sesión. Tal como se hace normalmente, si la sesión del usuario duró menos de 10 segundos, GDM asume que la sesión reventó y permite al usuario ver este archivo en un diálogo antes de volver a la pantalla de entrada. De esta manera el usuario puede ver los errores de la última sesión y corregir el problema.

Puede suprimir la advertencia de los 10 segundos devolviendo un código 66 desde el script `Xsession` desde el binario de la sesión (el script `Xsession` predeterminado propaga esos códigos hacia atrás). Esto es útil si tiene alguna clase de inicios de sesión especiales para los que no es un error retornar menos de esos 10 segundos después, o si configura la sesión para mostrar algún mensaje de error y el mensaje de GDM podría ser confuso y redundante.

La salida de la sesión se encauza a través del demonio gdm y así el archivo `~/.xsession-errors` está capado a cerca de 200 Kbytes por GDM para prevenir una posible denegación de servicio en la sesión. Una aplicación podría quizás leer algunos datos erróneos, imprimir advertencias o errores en stderr o stdout. Esto podría quizás llenar el directorio personal del usuario quien tendría que cerrar sesión e iniciar sesión de nuevo para limpiar esto. Esto podría ser especialmente duro si hay cuotas puestas. GDM además atrapa correctamente la señal XFSZ y para de escribir el archivo, lo que podría conducir a sesiones matadas si el archivo fue redirigido en la forma antigua desde el script.

Note que algunos distribuidores parecen ignorar la redirección de `~/.xsession-errors` y la hacen ellos mismos en su propio script Xsession (establecido por la clave de configuración `BaseXsession`) que significa que GDM no será capaz de atrapar la salida y cubrir este archivo. Puede también perder datos de salida del script `PreSession` lo que puede hacer la depuración mucho más complicada ya que quizás la salida de lo que está equivocado no se imprimirá. Vea la descripción de la clave de configuración `BaseXsession` para más información, especialmente acerca de cómo manejar múltiples gestores de entrada usando el mismo script.

Note que si la sesión es una sesión a prueba de fallos, o si GDM no puede abrir este archivo por alguna razón, entonces se creará un archivo de apoyo en el directorio `/tmp` llamado `/tmp/xses-<user>.XXXXXX` donde `XXXXXX` son caracteres aleatorios.

Si ejecuta un sistema sin cuotas activadas, será bueno borrar el archivo `~/.xsession-errors` en el script `PostSession`. Así este archivo de registro no está por medio innecesariamente.

### Acceso a los archivos

En general GDM es muy quisquilloso respecto a la lectura/escritura de archivos de usuario (como ~/.dmrc, ~/.face, ~/.xsession-errors, y ~/.Xauthority ). Por ejemplo se niega a acceder a cualquier cosa excepto archivos regulares. Enlaces, sockets y dispositivos se ignoran. El valor del parámetro `RelaxPermissions` determina si GDM debería aceptar archivos escribibles por el grupo del usuario u otros. Éstos se ignoran por omisión.

Todas las operaciones en los archivos del usuario se realizan con el id de usuario efectivo del usuario. Si el control de sanidad falla en el archivo `.Xauthority` del usuario, se crea una cookie de recuperación de errores en el directorio especificado por la opción de configuración `UserAuthFBDir` (/tmp por omisión).

Finalmente, el administrador del sistema puede especificar el tamaño máximo del archivo que GDM debería aceptar y, en el caso de que el visor de rostros esté activado, se fuerza un tamaño máximo del icono. En sistemas grandes se avisa además que desactive el visor de rostros por razones de rendimiento. Mirar iconos en directorios personales, escalarlos y renderizarlos puede llevar mucho tiempo.

### GDM Performance

To speed performance it is possible to build GDM so that it will preload libraries when GDM first displays a greeter program. This has been shown to speed first time login since these libraries can be loaded into memory while the user types in their username and password.

To use this feature, configure GDM with the --with-prefetch option. This will cause GDM to install the gdmprefetch program to the EXPANDED_LIBEXEC directory, install the gdmprefetchlist to the <etc>/gdm directory, and set the PreFetchProgram configuration variable so that the gdmprefetch program is called with the default gdmprefetchlist file. The default gdmprefetchlist file was optimized for a GNOME desktop running on Solaris, so may need fine-tuning on other systems. Alternative prefetchlist files can be contributed to the "gdm" category in bugzilla.gnome.org, so that they can be included in future GDM releases.

## Seguridad

### El usuario GDM

The GDM daemon normally runs as root, as does the slave. However GDM should also have a dedicated user id and a group id which it uses for its graphical interfaces such as `gdmgreeter` and `gdmlogin`. You can choose the name of this user and group in the `[daemon]` section of the configuration file.

El usuario y el grupo GDM, que son normalmente `gdm` no deberían tener ningún privilegio. La razón para usarlos es tener el interfaz de usuario ejecutándose como un usuario sin privilegios para que en el improbable caso de que alguien encuentre una debilidad en el IGU, no puedan acceder como root a la computadora.

It should however be noted that the GDM user and group have some privileges that make them somewhat dangerous. For one they have access to the X server authorization directory (the `ServAuthDir`), which contains all the X server authorization files and other private information. This means that someone who gains the GDM user/group privileges can then connect to any session. So you should not, under any circumstances, make this some user/group which may be easy to get access to, such as the user `nobody`.

### Esquema de autenticación del servidor X

The X server authorization directory (the `ServAuthDir`) is used for a host of random internal data in addition to the X server authorization files, and the naming is really a relic of history. GDM daemon enforces this directory to be owned by `root.gdm` with the permissions of 1770. This way, only root and the GDM group have write access to this directory, but the GDM group cannot remove the root owned files from this directory, such as the X server authorization files.

GDM by default doesn't trust the X server authorization directory and treats it in the same way as the temporary directory with respect to creating files. This way someone breaking the GDM user cannot mount attacks by creating links in this directory. Similarly the X server log directory is treated safely, but that directory should really be owned and writable only by root.

GDM only supports the MIT-MAGIC-COOKIE-1 X server authentication scheme. Normally little is gained from the other schemes, and no effort has been made to implement them so far. Be especially careful about using XDMCP because the X server authentication cookie goes over the wire as clear text. If snooping is possible, then an attacker could simply snoop your authentication password as you log in, regardless of the authentication scheme being used. If snooping is possible and undesirable, then you should use ssh for tunneling an X connection rather then using XDMCP. You could think of XDMCP as a sort of graphical telnet, having the same security issues.

On the upside, GDM's random number generation is very conservative and GDM goes to extraordinary measures to truly get a 128 bit random number, using hardware random number generators (if available), plus the current time (in microsecond precision), a 20 byte array of pseudorandom numbers, process pid's, and other random information (possibly using `/dev/audio` or `/dev/mem` if hardware random generators are not available) to create a large buffer and then run MD5 digest on this. Obviously, all this work is wasted if you send this cookie over an open network or store it on an NFS directory (see `UserAuthDir` configuration key). So be careful about where you use remote X display.

### Seguridad con cortafuegos

Even though GDM tries to outsmart potential attackers trying to take advantage of XDMCP, it is still advised that you block the XDMCP port (normally UDP port 177) on your firewall unless you really need it. GDM guards against DoS (Denial of Service) attacks, but the X protocol is still inherently insecure and should only be used in controlled environments. Also each remote connection takes up lots of resources, so it is much easier to DoS via XDMCP then a webserver.

It is also wise to block all of the X Server ports. These are TCP ports 6000 + the display number of course) on your firewall. Note that GDM will use display numbers 20 and higher for flexible on-demand servers.

X is not a very safe protocol for leaving on the net, and XDMCP is even less safe.

### Seguridad de GDM con NFS

Note that NFS traffic really goes "over the wire" and thus can be snooped. When accessing the user's X authorization file (~/.Xauthority), GDM will try to open the file for reading as root. If it fails, GDM will conclude that it is on an NFS mount and it will automatically use `UserAuthFBDir`, which by default is set to `/tmp`. This behavior can be changed by setting the `NeverPlaceCookiesOnNFS` in the `[security]` section to false.

### Seguridad de XDMCP

Even though your display is protected by cookies, XEvents and thus keystrokes typed when entering passwords will still go over the wire in clear text. It is trivial to capture these.

XDMCP is primarily useful for running thin clients such as in terminal labs. Those thin clients will only ever need the network to access the server, and so it seems like the best security policy to have those thin clients on a separate network that cannot be accessed by the outside world, and can only connect to the server. The only point from which you need to access outside is the server.

The above sections "X Server Authentication Scheme" and "Firewall Security" also contain important information about using XDMCP securely. The next section also discusses how to set up XDMCP access control.

### Control de acceso XDMCP

El control de acceso XDMCP se realiza por medio de TCP wrappers. Es posible compilar GDM sin TCP wrappers sin embargo debería probar su configuración y verificar que funciona.

Debería usar el nombre del demonio `gdm` en el archivo `<etc>/hosts.allow` y en el archivo `<etc>hosts.deny`. Por ejemplo para denegar la entrada a equipos de `.evil.domain` , añada

    gdm: .dominio.maligno

a `<etc>/hosts.deny`. También necesitará añadir

    gdm: .su.dominio

a su `<etc>/hosts.allow` si normalmente no permite todos los servicios desde todos los equipos. Vea la página del manual hosts.allow(5) para más detalles.

## Configuración

Esta sección cubrirá la configuración de GDM y el formato de los archivos de configuración de GDM. Puede usar el comando `gdmsetup` para configurar GDM, pero la aplicación de configuración no le deja configurar cada aspecto de GDM. La información de esta sección le explica en profundidad cómo configurar GDM.

Los archivos de configuración (especialmente `gdm.conf` y `gdm.conf-custom`) contienen comentarios útiles y ejemplos, así que léalos para más información acerca de cambiar su configuración.

Algunas claves en el archivo de configuración se entregan comentadas mientras que otras están activadas. Esto se hace para que los predeterminados para algunas claves puedan cambiarse fácilmente en el futuro. GDM considera que las líneas que comienzan con el carácter «#» un comentario, y estas líneas se ignorarán.

EL archivo `gdm.conf` contiene las opciones de configuración predeterminadas para GDM, y no debería ser modificado por el usuario. El archivo `gdm.conf-custom` es donde los usuarios pueden especificar sus opciones de configuración personalizadas. Las opciones de configuración especificadas en el archivo `gdm.conf-custom` toman precedencia sobre los valores en el archivo principal `gdm.conf`. Ejecutar el comando `gdmsetup` hará que el archivo `gdm.conf-custom` se modifique con las opciones de configuración del usuario y hará que cualquier programa del IGU de GDM se actualice automáticamente. Anteriormente a la versión 2.13.0.4 GDM sólo soportaba el archivo `gdm.conf`, así que si está usando una versión más antigua de GDM tan sólo edite ese archivo directamente.

GDM puede configurarse para soportar configuración para todo el sistema si se compila con la opción `--with-configdir`. Esto permite instalar el archivo gdm.conf en un directorio que pueda montarse a través de múltiples sistemas. La opción --config también podría usarse para especificar la ubicación del archivo de configuración. El demonio GDM2 debe reiniciarse para cambiar el archivo de configuración en uso.

`factory-gdm.conf` es el archivo de configuración tal como se empaqueta con el demonio. Esto puede ser útil si desea volver a la configuración predeterminada.

Los demás archivos de configuración de GDM se encuentran, por omisión, en la carpeta `<etc>/gdm/` o sus subdirectorios. sin embargo, la ubicación de todos los archivos de configuración pueden definirse en el archivo `gdm.conf`, así que el administrador del sistema puede elegir situar estos archivos en cualquier lugar.

Esta es una lista de los contenidos del directorio de configuración:

    locale.alias
    Xsession
    XKeepsCrashing
    modules/
    Init/
    PostLogin/
    PreSession/
    PostSession/

`locale.alias` es un archivo que se parece mucho al archivo de alias regionales del sistema pero no es el mismo. Éstos son los idiomas que están disponibles en su sitema. Todos los idiomas además se prueban para ver si actualmente existen antes de presentárselos al usuario.

`Xsession` es un script que configura una sesión de usuario y después ejecuta la selección de sesión del usuario. Note que el script de sesión se inicia típicamente por el archivo `desktop` asociado con la sesión que el usuario a escogido. Algunas sesiones quizá inicien la sesión del usuario por medio de un mecanismo diferente que el script `Xsession` así que marque el `desktop` apropiado antes de asumir que el problema de inicio está causado por este archivo.

`XKeepsCrashing` es un script que se ejecuta cuando el servidor X continúa colgándose y no se puede recuperar. El script predeterminado incluido funcionará con la mayoría de las distribuciones de Linux y puede ejecutar la aplicación de configuración de X siempre que la persona en la consola conozca la contraseña de root.

Accessibility modules are configured in the `modules/` subdirectory, and are a separate topic. Read the default files provided, they have adequate documentation. Again normally the default install is given in the files with `factory` in their name, and those files are not read, they are just there for you so you can always revert to default config.

Files describing available GDM session follow the freedesktop.org desktop file specification and are `.desktop`-style files are installed to `<etc>/X11/sessions/`. This directory is also read by the KDE desktop manager (KDM) for common configuration. Next the directory `<share>/gdm/BuiltInSessions/` is read for GDM specific built-in sessions (KDM hardcodes these at time of this writing). Lastly the default setup will also read `<share>/xsessions/` (which should be `/usr/share/xsessions/` if you really wish to cooperate with KDM) where desktop packages can install their session files. The directories under the `<etc>` should be reserved for configuration. The desktop file specification approach makes it easy for package management systems to install window managers and different session types without requiring the sysadmin to edit files. See the `SessionDesktopDir` configuration key for changing the paths. It used to be that GDM stored its built in sessions in `<etc>/dm/Sessions/` but this is deprecated as of 2.5.90.0. Note that prior to version 2.4.4.2 only the `<etc>/dm/Sessions/` was being read.

A session can be disabled (if it was installed in `/usr/share/xsessions/`) by adding an identically named `.desktop` to one of the directories earlier in the path (likely `<etc>/X11/sessions`) and using `Hidden=true` in that file.

### Los directorios de scripts

En esta sección explicaremos los directorios `Init`, `PostLogin`, `PreSession` y `PostSession` ya que son muy similares.

When the X server has been successfully started, GDM will try to run the script called `Init/<displayname>`. I.e. `Init/:0` for the first local display. If this file is not found, GDM will attempt to to run `Init/<hostname>`. I.e. `Init/somehost`. If this still is not found, GDM will try `Init/XDMCP` for all XDMCP logins or `Init/Flexi` for all on demand flexible displays. If none of the above were found, GDM will run `Init/Default`. The script will be run as root and GDM blocks until it terminates. Use the `Init/*` script for applications that are supposed to run alongside with the GDM login window. xconsole for instance. Commands to set the background etc. goes in this file too.

It is up to the sysadmin to decide whether clients started by the Init script should be killed before starting the user session. This is controlled with the `KillInitClients` configuration option.

When the user has been successfully authenticated GDM tries the scripts in the `PostLogin` directory in the same manner as for the `Init` directory. This is done before any session setup is done, and so this would be the script where you might setup the home directory if you need to (though you should use the `pam_mount` module if you can for this). You have the `$USER` and `$DISPLAY` environment variables set for this script, and again it is run as root. The script should return 0 on success as otherwise the user won't be logged in. This is not true for failsafe session however.

After the user session has been setup from the GDM side of things, GDM will run the scripts in the `PreSession` directory, again in the same manner as the `Init` directory. Use this script for local session management or accounting stuff. The `$USER` environment variable contains the login of the authenticated user and `$DISPLAY` is set to the current display. The script should return 0 on success. Any other value will cause GDM to terminate the current login process. This is not true for failsafe sessions however. Also `$X_SERVERS` environmental variable is set and this points to a fake generated X servers file for use with the sessreg accounting application.

After this the base `Xsession` script is run with the selected session executable as the first argument. This is run as the user, and really this is the user session. The available session executables are taken from the `Exec=` line in the `.desktop` files in the path specified by `SessionDesktopDir`. Usually this path is `<etc>/X11/sessions/:<etc>/dm/Sessions:/usr/share/xsessions/`. The first found file is used. The user either picks from these sessions or GDM will look inside the file `~/.dmrc` for the stored preference.

This script should really load the users profile and generally do all the voodoo that is needed to launch a session. Since many systems reset the language selections done by GDM, GDM will also set the `$GDM_LANG` variable to the selected language. You can use this to reset the language environmental variables after you run the users profile. If the user elected to use the system language, then `$GDM_LANG` is not set.

When the user terminates his session, the `PostSession` script will be run. Again operation is similar to `Init`, `PostLogin` and `PreSession`. Again the script will be run with root privileges, the slave daemon will block and the `$USER` environment variable will contain the name of the user who just logged out and `$DISPLAY` will be set to the display the user used, however note that the X server for this display may already be dead and so you shouldn't try to access it. Also `$X_SERVERS` environmental variable is set and this points to a fake generated X servers file for use with the sessreg accounting application.

Note that the `PostSession` script will be run even when the display fails to respond due to an I/O error or similar. Thus, there is no guarantee that X applications will work during script execution.

Except for the `Xsession` script all of these scripts will also have the environment variable `$RUNNING_UNDER_GDM` set to `yes`, so that you could perhaps use similar scripts for different display managers. The `Xsession` will always have the `$GDMSESSION` set to the basename of the session that the user chose to run without the `.desktop` extension. In addition `$DESKTOP_SESSION` is also set to the same value and in fact this will also be set by KDM in future versions.

Neither of the `Init`, `PostLogin`, `PreSession` or `PostSession` scripts are necessary and can be left out. The `Xsession` script is however required as well as at least one session `.desktop` file.

### The Configuration File - `gdm.conf` and `gdm.conf-custom`

GDM uses two configuration files: `gdm.conf` and `gdm.conf-custom`. The `gdm.conf` file contains the default configuration choices for GDM, and should not be modified by the user. The `gdm.conf-custom` file is where users may specify their custom configuration choices. Configuration options specified in the `gdm.conf-custom` file override the values in the main `gdm.conf` file. If a configuration option is not defined in either file, GDM will default to the value described in the comments in the `gdm.conf` file.

Running the `gdmsetup` command will cause the `gdm.conf-custom` to be modified with the user's configuration choices.

Previous to GDM 2.13.0.4 only the `gdm.conf` existed. If upgrading to the new version of GDM, install will check to see if your `gdm.conf` file is different than your `factory-gdm.conf` file. If so, your `gdm.conf` file will be automatically copied to `gdm.conf-custom` to preserve your configuration changes.

GDM may be configured to support system-wide configuration if built with the `--with-configdir` option. This allows the `gdm.conf` file to be installed to a directory that can be mounted across multiple-systems. The GDM --config option may instead be used to specify a configuration file installed to another location. The GDM2 daemon must be restarted to change the configuration file being used.

Both configuration files are divided into sections each containing variables that define the behavior for a specific part of the GDM suite. Refer to the comments in the `gdm.conf` file for additional information about each configuration setting.

The `gdm.conf` and `gdm.conf-custom` files follow the standard `.ini` style configuration file syntax. Keywords in brackets define sections, strings before an equal sign (=) are variables and the data after equal sign represents their value. Empty lines or lines starting with the hash mark (#) are ignored. The graphical configurator will try to preserve both comments (lines with a hash mark) and the overall structure of the file so you can intermix using the GUI or hand editing the configuration file.

#### Configuración del demonio

##### [daemon]

AddGtkModules

      AddGtkModules=false

  Si es true, entonces activa `gdmgreeter` o `gdmlogin` para que se lancen con módulos GTK+ adicionales. esto es útil cuando se requieren características extra como un inicio sesión accesible. Note que sólo deberían usarse los módulos «confiables» para minimizar las cuestiones de seguridad.

  Usualmente esto se usa para los módulos de accesibilidad. Los módulos que se cargan se especifican con la clave `GtkModulesList`.

AlwaysRestartServer

      AlwaysRestartServer=false

  If true, then gdm never tries to reuse existing X servers by reinitializing them. It will just kill the existing X server and start over. Normally, just reinitializing is a nicer way to go but if the X server memory usage keeps growing this may be a safer option. On Solaris, this value is always true, and this configuration setting is ignored.

AutomaticLoginEnable

      AutomaticLoginEnable=false

  If the user given in AutomaticLogin should be logged in upon first bootup. No password will be asked. This is useful for single user workstations where local console security is not an issue. Also could be useful for public terminals, although there see `TimedLogin`.

AutomaticLogin

      AutomaticLogin=

  This user should be automatically logged in on first bootup. AutomaticLoginEnable must be true and this must be a valid user for this to happen. "root" can never be autologged in however and gdm will just refuse to do it even if you set it up.

  Los siguientes caracteres de control se reconocen dentro del nombre especificado:

  the `' character

  d nombre del display

  h nombre de host del display

  Alternatively, the name may end with a vertical bar |, the pipe symbol. The name is then used as a application to execute which returns the desired username on standard output. If an empty or otherwise invalid username is returned, automatic login is not performed. This feature is typically used when several remote displays are used as internet kiosks, with a specific user to automatically login for each display.

BaseXsession

      BaseXsession=<etc>/gdm/Xsession

  This is the base X session file. When a user logs in, this script will be run with the selected session as the first argument. The selected session will be the `Exec=` from the `.desktop` file of the session.

  If you wish to use the same script for several different display managers, and wish to have some of the script run only for GDM, then you can check the presence of the `GDMSESSION` environmental variable. This will always be set to the basename of `.desktop` (without the extension) file that is being used for this session, and will only be set for GDM sessions. Previously some scripts were checking for `GDM_LANG`, but that is only set when the user picks a non-system default language.

  This script should take care of doing the "login" for the user and so it should source the `<etc>/profile` and friends. The standard script shipped with GDM sources the files in this order: `<etc>/profile` then `~/.profile` then `<etc>/xprofile` and finally `~/.xprofile`. Note that different distributions may change this however. Sometimes users personal setup will be in `~/.bash_profile`, however broken that is.

Chooser

      Chooser=<bin>/gdmchooser

  Ruta completa y nombre del ejecutable del selector seguido de archumentos opcionales.

Configurator

      Configurator=<bin>/gdmsetup --disable-sound --disable-crash-dialog

  The pathname to the configurator binary. If the greeter `ConfigAvailable` option is set to true then run this binary when somebody chooses Configuration from the Actions menu. Of course GDM will first ask for root password however. And it will never allow this to happen from a remote display.

ConsoleCannotHandle

      ConsoleCannotHandle=am,ar,az,bn,el,fa,gu,hi,ja,ko,ml,mr,pa,ta,zh

  These are the languages that the console cannot handle because of font issues. Here we mean the text console, not X. This is only used when there are errors to report and we cannot start X.

ConsoleNotify

      ConsoleNotify=true

  If false, gdm will not display a message dialog on the console when an error happens.

DefaultPath

      DefaultPath=/bin:/usr/bin:/usr/bin/X11:/usr/local/bin

  Specifies the path which will be set in the user's session. This value will be overridden with the value from /etc/default/login if it contains "ROOT=<pathname>". If the /etc/default/login file exists, but contains no value for ROOT, the value as defined in the GDM configuration will be be used.

DefaultSession

      DefaultSession=gnome.desktop

  The session that is used by default if the user does not have a saved preference and has picked 'Last' from the list of sessions. Note that 'Last' need not be displayed, see the `ShowLastSession` key.

DisplayInitDir

      DisplayInitDir=<etc>/gdm/Init

  Directory containing the display init scripts. See the ``The Script Directories'' section for more info.

DisplayLastLogin

      DisplayLastLogin=true

  If true then the last login information is printed to the user before being prompted for password. While this gives away some info on what users are on a system, it on the other hand should give the user an idea of when they logged in and if it doesn't seem kosher to them, they can just abort the login and contact the sysadmin (avoids running malicious startup scripts). This was added in version 2.5.90.0.

  This is for making GDM conformant to CSC-STD-002-85, although that is purely theoretical now. Someone should read that spec and ensure that this actually conforms (in addition to other places in GDM). See `http://www.radium.ncsc.mil/tpep/library/rainbow/CSC-STD-002-85.html` for more info.

DoubleLoginWarning

      DoubleLoginWarning=true

  If true, GDM will warn the user if they are already logged in on another virtual terminal. On systems where GDM supports checking the X virtual terminals, GDM will let the user switch to the previous login virtual terminal instead of logging in.

DynamicXServers

      DynamicXServers=false

  If true, the GDM daemon will honor requests to manage displays via the `/tmp/.gdm_socket` socket connection. Displays can be created, started, and deleted with the appropriate commands. The `gdmdynamic` command is a convenient method to send these messages.

FailsafeXServer

      FailsafeXServer=

  An X command line in case we can't start the normal X server. should probably be some sort of a script that runs an appropriate low resolution X server that will just work. This is tried before the `XKeepsCrashing` script is run.

FirstVT

      FirstVT=7

  On systems where GDM supports automatic VT (virtual terminal) allocation, this is the first vt to try. Usually standard text logins are run on the lower vts. See also `VTAllocation`.

FlexibleXServers

      FlexibleXServers=5

  The maximum number of allowed flexible displays. These are displays that can be run using the `/tmp/.gdm_socket` socket connection. This is used for both full flexible displays and for Xnest displays.

FlexiReapDelayMinutes

      FlexiReapDelayMinutes=5

  After how many minutes of inactivity at the login screen should a flexi display be reaped. This is only in effect before a user logs in. Also it does not affect the Xnest flexiservers. To turn off this behaviour set this value to 0. This was added in version 2.5.90.0.

Greeter

      Greeter=<bin>/gdmlogin

  Full path and name of the greeter executable followed by optional arguments. This is the greeter used for all displays except for the XDMCP remote displays. See also `RemoteGreeter`

Group

      Group=gdm

  The group name under which `gdmlogin`, `gdmgreeter`, `gdmchooser` and the internal failsafe GTK+ dialogs are run. Also see `User`. This user will have access to all the X authorization files, and perhaps to other internal GDM data and it should not therefore be a user such as nobody, but rather a dedicated user. The `ServAuthDir` is owned by this group. The ownership and permissions of `ServAuthDir` should be `root.gdm` and 1770.

GtkModulesList

      GtkModulesList=module-1:module-2:...

  A colon separated list of Gtk+ modules that `gdmgreeter` or `gdmlogin` will be invoked with if `AddGtkModules` is true. The format is the same as the standard Gtk+ module interface.

HaltCommand

      HaltCommand=/sbin/shutdown -h now

  Full path and arguments to command to be executed when user selects "Shut Down" from the Actions menu. This can be a ';' separated list of commands to try. If a value is missing, the shut down command is not available. Note that the default for this value is not empty, so to disable "Shut Down" it must be set to an empty value.

KillInitClients

      KillInitClients=true

  Determines whether GDM should kill X clients started by the init scripts when the user logs in.

Directorio de registro

      LogDir=<var>/log/gdm

  Directory containing the log files for the individual displays. By default this is the same as the ServAuthDir.

PidFile

      PidFile=<var>/run/gdm.pid

  Name of the file containing the `gdm` process id.

PreFetchProgram

      PreFetchProgram=command

  Program to be run by the GDM greeter/login program when the initial screen is displayed. The purpose is to provide a hook where files which will be used after login can be preloaded to speed performance for the user. The program will be called once only, the first time a greeter is displayed. The gdmprefetch command may be used. This utility will load any libraries passed in on the command line, or if the argument starts with a "@" character, it will process the file assuming it is an ASCII file containing a list of libraries, one per line, and load each library in the file.

PostLoginScriptDir

      PostLoginScriptDir=<etc>/gdm/PostLogin

  Directory containing the scripts run right after the user logs in, but before any session setup is done. See the ``The Script Directories'' section for more info.

PostSessionScriptDir

      PostSessionScriptDir=<etc>/gdm/PostSession

  Directory containing the scripts run after the user logs out. See the ``The Script Directories'' section for more info.

PreSessionScriptDir

      PreSessionScriptDir=<etc>/gdm/PreSession

  Directory containing the scripts run before the user logs in. See the ``The Script Directories'' section for more info.

RebootCommand

      RebootCommand=/sbin/shutdown -r now

  Full path and optional arguments to the command to be executed when user selects Restart from the Actions menu. This can be a ';' separated list of commands to try. If missing, the restart command is not available. Note that the default for this value is not empty so to disable restart you must set this explicitly to an empty value.

RemoteGreeter

      RemoteGreeter=<bin>/gdmlogin

  Full path and name of the greeter executable followed by optional arguments. This is used for all remote XDMCP sessions. It is useful to have the less graphically demanding greeter here if you use the Themed Greeter for your main greeter. See also the `Greeter` key.

RootPath

      RootPath=/sbin:/usr/sbin:/bin:/usr/bin:/usr/bin/X11:/usr/local/bin

  Specifies the path which will be set in the root's session and the {Init,PostLogin,PreSession,PostSession} scripts executed by GDM. This value will be overridden with the value from /etc/default/login if it contains "SUROOT=<pathname>". If the /etc/default/login file exists, but contains no value for SUROOT, the value as defined in the GDM configuration will be used.

ServAuthDir

      ServAuthDir=<var>/gdm

  Directory containing the X authentication files for the individual displays. Should be owned by `root.gdm` with permissions 1770, where `gdm` is the GDM group as defined by the `Group` option. That is should be owned by root, with `gdm` group having full write permissions and the directory should be sticky and others should have no permission to the directory. This way the GDM user can't remove files owned by root in that directory, while still being able to write its own files there. GDM will attempt to change permissions for you when it's first run if the permissions are not the above. This directory is also used for other private files that the daemon needs to store. Other users should not have any way to get into this directory and read/change it's contents. Anybody who can read this directory can connect to any display on this computer.

SessionDesktopDir

      SessionDesktopDir=<etc>/X11/sessions/:<etc>/dm/Sessions/:</usr/share>/xsessions/

  Directory containing the `.desktop` files which are the available sessions on the system. Since 2.4.4.2 this is treated like a PATH type variable and the first file found is used.

SoundProgram

      SoundProgram=/usr/bin/play

  Application to use when playing a sound. Currently used for playing the login sound, see the `SoundOnLoginFile` key. Supported since 2.5.90.0.

StandardXServer

      StandardXServer=/usr/X11R6/bin/X

  Full path and arguments to the standard X server command. This is used when gdm cannot find any other definition, and it's used as the default and failsafe fallback in a number of places. This should be able to run some sort of X server.

SuspendCommand

      SuspendCommand=

  Full path and arguments to command to be executed when user selects Suspend from the Actions menu. If empty there is no such menu item. Note that the default for this value is not empty so to disable suspend you must set this explicitly to an empty value.

TimedLoginEnable

      TimedLoginEnable=false

  If the user given in `TimedLogin` should be logged in after a number of seconds (set with `TimedLoginDelay`) of inactivity on the login screen. This is useful for public access terminals or perhaps even home use. If the user uses the keyboard or browses the menus, the timeout will be reset to `TimedLoginDelay` or 30 seconds, whichever is higher. If the user does not enter a username but just hits the ENTER key while the login program is requesting the username, then GDM will assume the user wants to login immediately as the timed user. Note that no password will be asked for this user so you should be careful, although if using PAM it can be configured to require password entry before allowing login.

TimedLogin

      TimedLogin=

  This is the user that should be logged in after a specified number of seconds of inactivity. This can never be "root" and gdm will refuse to log in root this way. The same features as for `AutomaticLogin` are supported. The same control chars and piping to a application are supported.

TimedLoginDelay

      TimedLoginDelay=30

  Este es el retardo antes de que el usuario `TimedLogin` entre en la sesión. Debe ser mayor o igual a 10.

User

      User=gdm

  The username under which `gdmlogin`, `gdmgreeter`, `gdmchooser` and the internal failsafe GTK+ dialogs are run. Also see `Group`. This user will have access to all the X authorization files, and perhaps to other internal GDM data and it should not therefore be a user such as nobody, but rather a dedicated user.

UserAuthDir

      UserAuthDir=

  The directory where user's `.Xauthority` file should be saved. When nothing is specified the user's home directory is used. This is tilde expanded so you can set it to things like: `~/authdir/`.

  If you do not use the tilde expansion, then the filename created will be random, like in `UserAuthFBDir`. This way many users can have the same authentication directory. For example you might want to set this to `/tmp` when user has the home directory on NFS, since you really don't want cookie files to go over the wire. The users should really have write privileges to this directory, and this directory should really be sticky and all that, just like the `/tmp` directory.

  Normally if this is the users home directory GDM will still refuse to put cookies there if it thinks it is NFS (by testing root-squashing). This can be changed by setting `NeverPlaceCookiesOnNFS` in the `[security]` section to false.

UserAuthFBDir

      UserAuthFBDir=/tmp

  If GDM fails to update the user's `.Xauthority` file a fallback cookie is created in this directory.

UserAuthFile

      UserAuthFile=.Xauthority

  Name of the file used for storing user cookies.

VTAllocation

      VTAllocation=true

  On systems where GDM supports automatic VT (virtual terminal) allocation (currently Linux and FreeBSD only), you can have GDM automatically append the vt argument to the X server executable. This way races that come up from each X server managing it's own vt allocation can be avoided. See also `FirstVT`.

XKeepsCrashing

      XKeepsCrashing=<etc>/gdm/XKeepsCrashing

  A script to run in case X keeps crashing. This is for running An X configuration or whatever else to make the X configuration work. See the script that came with the distribution for an example. The distributed `XKeepsCrashing` script is tested on Red Hat, but may work elsewhere. Your system integrator should make sure this script is up to date for your particular system.

  En caso de que esté configurado `FailsafeXServer`, ése se intentará primero, y este sólo se usará como un respaldo en el caso de que el servidor X se mantenga colgado.

Xnest

      Xnest=/usr/bin/X11/Xnest (/usr/openwin/bin/Xnest on Solaris)

  The full path and arguments to the Xnest command. This is used for the flexible Xnest displays. This way the user can start new login screens in a nested window. Of course you must have the Xnest display from your X server packages installed for this to work.

#### Opciones de seguridad

##### [security]

AllowRoot

      AllowRoot=true

  Permite al usuario root (usuario privilegiado) entrar a través de GDM. Establezca esta opción a false si quiere no permitir dichas entradas.

  On systems that support PAM, this parameter is not as useful as you can use PAM to do the same thing, and in fact do even more. However it is still followed, so you should probably leave it true for PAM systems.

AllowRemoteRoot

      AllowRemoteRoot=false

  Allow root (privileged user) to log in remotely through GDM. This value should be set to true to allow such logins. Remote logins are any logins that come in through the XDMCP.

  On systems that support PAM, this parameter is not as useful since you can use PAM to do the same thing, and do even more.

  This value will be overridden and set to false if the /etc/default/login file exists and contains "CONSOLE=/dev/login", and set to true if the /etc/default/login file exists and contains any other value or no value for CONSOLE.

AllowRemoteAutoLogin

      AllowRemoteAutoLogin=false

  Allow the timed login to work remotely. That is, remote connections through XDMCP will be allowed to log into the "TimedLogin" user by letting the login window time out, just like the local user on the first console.

  Note that this can make a system quite insecure, and thus is off by default.

CheckDirOwner

      CheckDirOwner=true

  By default GDM checks the ownership of the home directories before writing to them, this prevents security issues in case of bad setup. However in some instances home directories will be owned by a different user and in this case it is necessary to turn this option on. You will also most likely have to turn the `RelaxPermissions` key to at least value 1 since in such a scenario home directories are likely to be group writable. Supported since 2.6.0.4.

DisallowTCP

      DisallowTCP=true

  If true, then always append `-nolisten tcp` to the command line of local X servers, thus disallowing TCP connection. This is useful if you do not care for allowing remote connections, since the X protocol could really be potentially a security hazard to leave open, even though no known security problems exist.

NeverPlaceCookiesOnNFS

      NeverPlaceCookiesOnNFS=true

  Normally if this is true (which is by default), GDM will not place cookies into the users home directory if this directory is on NFS. Well, GDM will consider any filesystem with root-squashing an NFS filesystem. Sometimes however the remote file system can have root squashing and be safe (perhaps by using encryption). In this case set this to 'false'. Note that this option appeared in version 2.4.4.4 and is ignored in previous versions.

PasswordRequired

      PasswordRequired=false

  If true, this will cause PAM_DISALLOW_NULL_AUTHTOK to be passed as a flag to pam_authenticate and pam_acct_mgmt, disallowing NULL password. This setting will only take effect if PAM is being used by GDM. This value will be overridden with the value from /etc/default/login if it contains "PASSREQ=[YES|NO]". If the /etc/default/login file exists, but contains no value for PASSREQ, the value as defined in the GDM configuration will be used.

RelaxPermissions

      RelaxPermissions=0

  By default GDM ignores files and directories writable to other users than the owner.

  Cambiar el valor de RelaxPermissions hace posible alterar este comportamiento:

  0 - Paranoia option. Only accepts user owned files and directories.

  1 - Allow group writable files and directories.

  2 - Allow world writable files and directories.

RetryDelay

      RetryDelay=1

  The number of seconds GDM should wait before reactivating the entry field after a failed login.

UserMaxFile

      UserMaxFile=65536

  GDM rechazará a leer/escribir archivos mayores que este número (especificado en bytes).

  In addition to the size check GDM is extremely picky about accessing files in user directories. It will not follow symlinks and can optionally refuse to read files and directories writable by other than the owner. See the `RelaxPermissions` option for more info.

#### Soporte XDCMP

##### [xdmcp]

DisplaysPerHost

      DisplaysPerHost=1

  To prevent attackers from filling up the pending queue, GDM will only allow one connection for each remote computer. If you want to provide display services to computers with more than one screen, you should increase the `DisplaysPerHost` value accordingly.

  Note that the number of connections from the local computer is unlimited. Only remote connections are limited by this number.

Enable

      Enable=false

  Setting this to true enables XDMCP support allowing remote displays/X terminals to be managed by GDM.

  `gdm` listens for requests on UDP port 177. See the Port option for more information.

  If GDM is compiled to support it, access from remote displays can be controlled using the TCP Wrappers library. The service name is `gdm`

  You should add

      gdm:.my.domain

  to your `<etc>/hosts.allow`, depending on your TCP Wrappers configuration. See the hosts.allow(5) man page for details.

  Note que XDMCP no es un protocolo particularmente seguro y que es una buena idea bloquear el puerto UDP 177 en su cortafuegos a no ser que realmente lo necesite.

EnableProxy

      EnableProxy=false

  Setting this to true enables support for running XDMCP sessions on a local proxy X server. This may improve the performance of XDMCP sessions, especially on high latency networks, as many X protocol operations can be completed without going over the network.

  Note, however, that this mode will significantly increase the burden on the machine hosting the XDMCP sessions

  See the `FlexiProxy` and `FlexiProxyDisconnect` options for further details on how to configure support for this feature.

HonorIndirect

      HonorIndirect=true

  Enables XDMCP INDIRECT choosing (i.e. remote execution of `gdmchooser`) for X-terminals which don't supply their own display browser.

MaxPending

      MaxPending=4

  To avoid denial of service attacks, GDM has fixed size queue of pending connections. Only MaxPending displays can start at the same time.

  Please note that this parameter does *not* limit the number of remote displays which can be managed. It only limits the number of displays initiating a connection simultaneously.

MaxPendingIndirect

      MaxPendingIndirect=4

  GDM will only provide `MaxPendingIndirect` displays with host choosers simultaneously. If more queries from different hosts come in, the oldest ones will be forgotten.

MaxSessions

      MaxSessions=16

  Determines the maximum number of remote display connections which will be managed simultaneously. I.e. the total number of remote displays that can use your host.

MaxWait

      MaxWait=30

  When GDM is ready to manage a display an ACCEPT packet is sent to it containing a unique session id which will be used in future XDMCP conversations.

  GDM will then place the session id in the pending queue waiting for the display to respond with a MANAGE request.

  If no response is received within MaxWait seconds, GDM will declare the display dead and erase it from the pending queue freeing up the slot for other displays.

MaxWaitIndirect

      MaxWaitIndirect=30

  The MaxWaitIndirect parameter determines the maximum number of seconds between the time where a user chooses a host and the subsequent indirect query where the user is connected to the host. When the timeout is exceeded, the information about the chosen host is forgotten and the indirect slot freed up for other displays. The information may be forgotten earlier if there are more hosts trying to send indirect queries then `MaxPendingIndirect`.

Port

      Port=177

  The UDP port number `gdm` should listen to for XDMCP requests. Don't change this unless you know what you are doing.

PingIntervalSeconds

      PingIntervalSeconds=15

  Interval in which to ping the X server in seconds. If the X server doesn't return before the next time we ping it, the connection is stopped and the session ended. This is a combination of the XDM PingInterval and PingTimeout, but in seconds.

  Note that GDM in the past used to have a `PingInterval` configuration key which was also in minutes. For most purposes you'd want this setting to be lower then one minute however since in most cases where XDMCP would be used (such as terminal labs), a lag of more than 15 or so seconds would really mean that the terminal was turned off or restarted and you would want to end the session.

ProxyReconnect

      FlexiProxyReconnect=

  Setting this option enables experimental support for session migration with XDMCP sessions. This enables users to disconnect from their session and later reconnect to that same session, possibly from a different terminal.

  In order to use this feature, you must have a nested X server available which supports disconnecting from its parent X server and reconnecting to another X server. Currently, the Distributed Multihead X (DMX) server supports this feature to some extent and other projects like NoMachine NX are busy implementing it.

  This option should be set to the path of a command which will handle reconnecting the XDMCP proxy to another backend display. A sample implementation for use with DMX is supplied.

ProxyXServer

      ProxyXServer=

  The X server command line for a XDMCP proxy. Any nested X server like Xnest, Xephr or Xdmx should work fairly well.

Willing

      Willing=<etc>/gdm/Xwilling

  When the machine sends a WILLING packet back after a QUERY it sends a string that gives the current status of this server. The default message is the system ID, but it is possible to create a script that displays customized message. If this script doesn't exist or this key is empty the default message is sent. If this script succeeds and produces some output, the first line of it's output is sent (and only the first line). It runs at most once every 3 seconds to prevent possible denial of service by flooding the machine with QUERY packets.

#### Common GUI Configuration Options

##### [gui]

AllowGtkThemeChange

      AllowGtkThemeChange=true

  If to allow changing the GTK+ (widget) theme from the greeter. Currently this only affects the standard greeter as the graphical greeter does not yet have this ability. The theme will stay in effect on this display until changed and will affect all the other windows that are put up by GDM. Supported since 2.5.90.2.

GtkRC

      GtkRC=

  Path to a `gtkrc` to read when GDM puts up a window. You should really now use the `GtkTheme` key for just setting a theme.

GtkTheme

      GtkTheme=Default

  A name of an installed theme to use by default. It will be used in the greeter, chooser and all other GUI windows put up by GDM. Supported since 2.5.90.2.

GtkThemesToAllow

      GtkThemesToAllow=all

  Comma separated list of themes to allow. These must be the names of the themes installed in the standard locations for GTK+ themes. You can also specify 'all' to allow all installed themes. This is related to the `AllowGtkThemeChange` key. Supported since 2.5.90.2.

MaxIconWidth

      MaxIconWidth=128

  Specifies the maximum icon width (in pixels) that the face browser will display. Icons larger than this will be scaled. This also affects icons in the XDMCP chooser.

MaxIconHeight

      MaxIconHeight=128

  Specifies the maximum icon height (in pixels) that the face browser will display. Icons larger than this will be scaled. This also affects icons in the XDMCP chooser.

#### Configuración del interfaz

##### [greeter]

BackgroundColor

      BackgroundColor=#76848F

  If the BackgroundType is 2, use this color in the background of the greeter. Also use it as the back of transparent images set on the background and if the BackgroundRemoteOnlyColor is set and this is a remote display. This only affects the GTK+ Greeter.

BackgroundProgramInitialDelay

      BackgroundProgramInitialDelay=30

  The background application will be started after at least that many seconds of inactivity.

RestartBackgroundProgram

      RestartBackgroundProgram=true

  If set the background application will be restarted when it has exited, after the delay described below has elapsed. This option can be useful when you wish to run a screen saver application when no user is using the computer.

BackgroundProgramRestartDelay

      BackgroundProgramRestartDelay=30

  The background application will be restarted after at least that many seconds of inactivity.

BackgroundImage

      BackgroundImage=somefile.png

  If the BackgroundType is 1, then display this file as the background in the greeter. This only affects the GTK+ Greeter.

BackgroundProgram

      BackgroundProgram=/usr/bin/xeyes

  If set this command will be run in the background while the login window is being displayed. Note that not all applications will run this way, since GDM does not usually have a home directory. You could set up home directory for the GDM user if you wish to run applications which require it. This only affects the GTK+ Greeter.

BackgroundRemoteOnlyColor

      BackgroundRemoteOnlyColor=true

  On remote displays only set the color background. This is to make network load lighter. The `BackgroundProgram` is also not run. This only affects the GTK+ Greeter.

BackgroundScaleToFit

      BackgroundScaleToFit=true

  Scale background image to fit the screen. This only affects the GTK+ Greeter.

BackgroundType

      BackgroundType=2

  El tipo de fondo a establecer. 0 es ninguno, 1 es imagen y color, 2 es color y 3 es imagen. Esto sólo afecta al interfaz GTK+.

Browser

      Browser=true

  Set to true to enable the face browser. See the ``The GTK+ Greeter'' section for more information on the face browser. This option only works for the GTK+ Greeter. For the Themed Greeter, the face browser is enabled by choosing a theme which includes a face browser

ChooserButton

      ChooserButton=true

  If true, add a chooser button to the Actions menu that will restart the current X server with a chooser. XDMCP does not need to be enabled on the local computer for this to work.

ConfigAvailable

      ConfigAvailable=false

  If true, allows the configurator to be run from the greeter. Note that the user will need to type in the root password before the configurator will be started. This is set to false by default for additional security. See the `Configurator` option in the daemon section.

DefaultFace

      DefaultFace=<share>/pixmaps/nophoto.png

  If a user has no defined face image, GDM will use the "stock_person" icon defined in the current GTK+ theme. If no such image is defined, the image specified by `DefaultFace` will be used. The image must be in an gdk-pixbuf supported format and the file must be readable to the GDM user.

Include

      Include=

  Comma separated list of users to be included in the face browser and in the `gdmsetup` selection list for Automatic/Timed login. See also `Exclude`, `IncludeAll`, and `MinimalUID`.

Exclude

      Exclude=bin,daemon,adm,lp,sync,shutdown,halt,mail,...

  Comma separated list of users to be excluded from the face browser and from the `gdmsetup` selection list for Automatic/Timed login. Excluded users will still be able to log in, but will have to type their username. See also `Include`, `IncludeAll`, and `MinimalUID`.

IncludeAll

      IncludeAll=false

  By default, an empty include list means display no users. By setting IncludeAll to true, the password file will be scanned and all users will be displayed aside from users excluded via the Exclude setting and user ID's less than MinimalUID. Scanning the password file can be slow on systems with large numbers of users and this feature should not be used in such environments. See also `Include`, `Exclude`, and `MinimalUID`.

GlobalFaceDir

      GlobalFaceDir=<share>/pixmaps/faces/

  Systemwide directory for face files. The sysadmin can place icons for users here without touching their homedirs. Faces are named after their users' logins.

  I.e. `<GlobalFaceDir>/johndoe` would contain the face icon for the user ``johndoe''. No image format extension should be specified.

  The face images must be stored in gdk-pixbuf supported formats and they must be readable for the GDM user.

  A user's own icon file will always take precedence over the sysadmin provided one.

GraphicalTheme

      GraphicalTheme=circles

  The graphical theme that the Themed Greeter should use. it should refer to a directory in the theme directory set by `GraphicalThemeDir`.

GraphicalThemes

      GraphicalThemes=circles

  The graphical themes that the Themed Greeter should use is the Mode is set on Random Themes. This is a "/:" delimited list. It should refer to a directory in the theme directory set by `GraphicalThemeDir`. This is only used if `GraphicalThemeRand` is set to true.

GraphicalThemeRand

      GraphicalThemeRand=false

  Whether the graphical greeter will use Only One Theme or Random Theme mode. Only One Theme mode uses themes listed by `GraphicalTheme`, Random Themes mode uses themes listed by `GraphicalThemes`. A value of false sets greeter to use Only One Theme mode, a value of true sets the greeter to use Random Theme mode.

GraphicalThemeDir

      GraphicalThemeDir=<share>/gdm/themes/

  The directory where themes for the Themed Greeter are installed.

GraphicalThemedColor

      GraphicalThemedColor=#76848F

  Use this color in the background of the Themed Greeter. This only affects the Themed Greeter.

InfoMsgFile

      InfoMsgFile=/path/to/infofile

  If present and /path/to/infofile specifies an existing and readable text file (e.g. <etc>/infomsg.txt) the contents of the file will be displayed in a modal dialog box before the user is allowed to login. This works both with the standard and the themable greeters.

InfoMsgFont

      InfoMsgFont=fontspec

  If present and InfoMsgFile (see above) is used, this specifies the font to use when displaying the contents of the InfoMsgFile text file. For example fontspec could be Sans 24 to get a sans serif font of size 24 points. This works both with the standard and the themable greeters.

LocaleFile

      LocaleFile=<etc>/gdm/locale.alias

  File in format similar to the GNU locale format with entries for all supported languages on the system. The format is described above or in a comment inside that file.

LockPosition

      LockPosition=true

  If true the position of the login window of the GTK+ Greeter cannot be changed even if the title bar is turned on.

Logo

      Logo=<share>/pixmaps/gnome-logo-large.png

  Image file to display in the logo box. The file must be in an gdk-pixbuf supported format and it must be readable by the GDM user. If no file is specified the logo feature is disabled. This only affects the GTK+ Greeter.

ChooserButtonLogo

      ChooserButtonLogo=<share>/pixmaps/gnome-logo-large.png

  Image file to display in the file chooser button in `gdmsetup`. This key is modified by `gdmsetup` and should not be manually modified by the user. This only affects the Login Window Preferences (`gdmsetup`).

MinimalUID

      MinimalUID=100

  The minimal UID that GDM should consider a user. All users with a lower UID will be excluded from the face browser. See also `Include`, `Exclude`, and `IncludeAll`.

PositionX

      PositionX=200

  The horizontal position of the login window of the GTK+ Greeter.

PositionY

      PositionY=100

  The vertical position of the login window of the GTK+ Greeter.

Quiver

      Quiver=true

  Controls whether `gdmlogin` should shake the display when an incorrect username/password is entered. This only affects the GTK+ Greeter.

DefaultRemoteWelcome

      DefaultRemoteWelcome=true

  If set to true, the value "Welcome to %n" is used for the `RemoteWelcome`. This value is translated into the appropriate language for the user. If set to false, the `RemoteWelcome` setting is used. This string can use the same special character sequences as explained in the "Text Node" section of the "Themed Greeter" chapter. This explains the meaning of "%n".

RemoteWelcome

      RemoteWelcome=Welcome to n

  Controls which text to display next to the logo image in the greeter for remote XDMCP sessions. The same expansion is done here as in the `Welcome` string. This string can use the same special character sequences as explained in the "Text Node" section of the "Themed Greeter" chapter. chapter.

RunBackgroundProgramAlways

      RunBackgroundProgramAlways=false

  If this is true then the background application is run always, otherwise it is only run when the `BackgroundType` is 0 (None) This only affects the GTK+ Greeter.

SetPosition

      SetPosition=true

  If true the position of the login window of the GTK+ Greeter is determined by `PositionX` / `PositionY`.

ShowGnomeFailsafeSession

      ShowGnomeFailsafeSession=true

  Should the greeter show the Gnome Failsafe session in th sessions list.

ShowLastSession

      ShowLastSession=true

  Should the greeter show the 'Last' session in the session list. If this is off, then GDM is in the so called 'switchdesk' mode which for example Red Hat uses. That is, the users can't pick the last session and will just then get the default session (see `DefaultSession`) unless then pick something else for this session only. So if this is off, this really circumvents saving of the last session.

ShowXtermFailsafeSession

      ShowXtermFailsafeSession=true

  Should the greeter show the Xterm Failsafe session in the sessions list.

SoundOnLogin

      SoundOnLogin=true

  If true, the greeter will play a sound or beep when it is ready for a login. See also the `SoundOnLoginFile` key. Supported since 2.5.90.0.

SoundOnLoginSuccess

      SoundOnLoginSuccess=true

  If true, the greeter will play a sound after a successful login attempt. See also the `SoundOnLoginSuccessFile` key.

SoundOnLoginFailure

      SoundOnLoginFailure=true

  If true, the greeter will play a sound after a failed login attempt. See also the `SoundOnLoginFailureFile` key.

SoundOnLoginFile

      SoundOnLoginFile=/path/to/sound.wav

  The file that will be played using the specified sound application (by default that is `/usr/bin/play`) instead of a beep when the greeter is ready for a login. See also the `SoundOnLogin` key and the `SoundProgram` key. Supported since 2.5.90.0.

SoundOnLoginSuccessFile

      SoundOnLoginSuccessFile=/path/to/sound.wav

  The file that will be played using the specified sound application (by default that is `/usr/bin/play`) after a successful login attempt. See also the `SoundOnLoginSuccess` key and the `SoundProgram` key.

SoundOnLoginFailureFile

      SoundOnLoginFailureFile=/path/to/sound.wav

  The file that will be played using the specified sound application (by default that is `/usr/bin/play`) after a failed login attempt. See also the `SoundOnLoginFailure` key and the `SoundProgram` key.

SystemMenu

      SystemMenu=true

  Turns the Actions menu (which used to be called System menu) on or off. If this is off then one of the actions will be available anywhere. These actions include Shutdown, Restart, Configure, XDMCP chooser and such. All of those can however be turned off individually. Shutdown, Restart and Suspend can be turned off by just setting the corresponding keys to empty. Note that the actions menu is only shown on local logins as it would not be safe or even desirable on remote logins, so you don't have to worry about remote users having any sort of console privileges.

  Note that if this is off none of the actions will be available even if a theme for a graphical greeter mistakenly shows them. Also note that sometimes a graphical theme may not show all the available actions as buttons and you may have to press F10 to see the menu.

TitleBar

      TitleBar=true

  Display the title bar in the greeter. This only affects the GTK+ Greeter.

Use24Clock

      Use24Clock=auto

  Select the use of 24 hour clock. Some locales do not support 12 hour format (like Finnish, that is `fi_FI`), and in those locales this setting has no effect at all.

  Possible values are "auto" (default), "true", and "false". If this is set to "auto" or left empty, then time format is chosen from locale settings. Locale settings are based on the language in use, thus it is changed by setting environment variables LANGUAGE (GNU extension), LANG, LC_MESSAGES or LC_ALL in the GDM's runtime environment. Priorities between the mentioned environment variables can be found from your system's C library manual.

UseCirclesInEntry

      UseCirclesInEntry=false

  Use circles instead of asterisks in the password entry. This may not work with all fonts however.

UseInvisibleInEntry

      UseInvisibleInEntry=false

  Do not show any visual feedback is the password entry. This is the standard in console and xdm. Settings this option discards the `UseCirclesInEntry` option.

DefaultWelcome

      DefaultWelcome=true

  If set to true, the value "Welcome" is used for the `Welcome`. This value is translated into the appropriate language for the user. If set to false, the `Welcome` setting is used.

Welcome

      Welcome=Welcome

  Controls which text to display next to the logo image in the standard greeter. The following control chars are supported:

  the `' character

  d display's hostname

  h Fully qualified hostname

  m machine (processor type)

  n Nodename (i.e. hostname without .domain)

  r release (OS version)

  s sysname (i.e. OS)

  This string is only used for local logins. For remote XDMCP logins we use `RemoteWelcome`.

  In the Themed Greeter the location of this text depends on the theme. Unless the theme uses the stock welcome string somewhere this string will not be displayed at all.

XineramaScreen

      XineramaScreen=0

  If the Xinerama extension is active the login window will be centered on this physical screen (use 0 for the first screen, 1 for the second...).

#### XDCMP Chooser Options

##### [chooser]

AllowAdd

      AllowAdd=true

  If true, allow the user to add arbitrary hosts to the chooser. This way the user could connect to any host that responds to XDMCP queries from the chooser.

Broadcast

      Broadcast=true

  If true, the chooser will broadcast a query to the local network and collect responses. This way the chooser will always show all available managers on the network. If you need to add some hosts not local to this network, or if you don't want to use a broadcast, you can list them explicitly in the `Hosts` key.

Multicast

      Multicast=true

  If true and IPv6 is enabled, the chooser will send a multicast query to the local network and collect responses from the hosts who have joined multicast group. If you don't want to send a multicast, you can specify IPv6 address in the `Hosts` key. The host will respond if it is listening to XDMCP requests and IPv6 is enabled there.

MulticastAddr

      MulticastAddr=ff02::1

  This is the Link-local Multicast address and is hardcoded here.

DefaultHostImage

      DefaultHostImage=<share>/pixmaps/nohost.png

  File name for the default host icon. This image will be displayed if no icon is specified for a given host. The file must be in an gdk-pixbuf supported format and it must be readable for the GDM user.

HostImageDir

      HostImageDir=<share>/hosts

  Repository for host icon files. The sysadmin can place icons for remote hosts here and they will appear in `gdmchooser`.

  The file name must match the fully qualified name (FQDN) for the host. The icons must be stored in gdk-pixbuf supported formats and they must be readable to the GDM user.

Hosts

      Hosts=host1,host2

  The hosts which should be listed in the chooser. The chooser will only list them if they respond. This is done in addition to broadcast (if `Broadcast` is set), so you need not list hosts on the local network. This is useful if your networking setup doesn't allow all hosts to be reachable by a broadcast packet.

ScanTime

      ScanTime=4

  Specifies how many seconds the chooser should wait for replies to its BROADCAST_QUERY. Really this is only the time in which we expect a reply. We will still add hosts to the list even if they reply after this time.

#### Configuración de depuración

##### [debug]

Enable

      Enable=false

  Setting to true sends debug ouput to the syslog. This can be useful for tracking down problems with GDM. This output tends to be verbose so should not be turned on for general use.

Gestures

      Gestures=false

  Setting to true sends debug ouput concerning the accessibility gesture listeners to the syslog. This can be useful for tracking down problems with them not working properly. This output tends to be verbose so should not be turned on for general use.

#### X Server Definitions

To set up X servers, you need to provide GDM with information about the installed X servers. You can have as many different definitions as you wish, each identified with a unique name. The name `Standard` is required. If you do not specify this server, GDM will assume default values for a 'Standard' server and the path given by `daemon/StandardXServer`. `Standard` is used as the default, in situations when no other server has been defined.

Servers are defined by sections named `server-` followed by the identifier of this server. This should be a simple ASCII string with no spaces. The GUI configuration program allows users to edit the servers defined in the GDM configuration files but currently does not allow adding or deleting entries. Like normal configuration options, `server-` sections in the `gdm.conf-custom` file override values in the `gdm.conf` file. In other words, if a `server-Standard` section is defined in `gdm.conf-custom`, then that will be used and the section in the `gdm.conf` file will be ignored.

##### [server-Standard]

name

      name=Standard server

  The name that will be displayed to the user.

command

      command=/usr/bin/X11/X

  The command to execute, with full path to the binary of the X server, and any extra arguments needed.

flexible

      flexible=true

  Indicates if this server is available as a choice when a user wishes to run a flexible, on demand server.

handled

      handled=true

  Indicates that GDM should run the login window on this server and allow a user to log in. If set to false, then GDM will just run this server and wait for it to terminate. This can be useful to run an X terminal using GDM. When this is done you should normally also add `-terminate` to the command line of the server to make the server terminate after each session. Otherwise the control of the slave will never come back to GDM and, for example, soft restarts won't work. This is because GDM assumes there is a login in progress for the entire time this server is active.

chooser

      chooser=false

  Indicates that GDM should instead of a login window run a chooser on this window and allow the user to choose which server to log into.

#### Local Static X Display Configuration

The static display configuration specifies what displays should be always managed by GDM. GDM will restart the X server on the display if it dies, for example. There may be as many static displays that are managed as you wish, although typically each display is associated with a real display. For example, if a machine has two displays (say display ":0" and display ":1"), then this section can be used to specify that a separate login screen be managed for each screen. Each key in the `[servers]` section corresponds to the display number to be managed. Normally there is only one key, which is the key `0`, which corresponds to the display `:0`.

The GUI configuration program allows users to edit the static display configuration defined in the GDM configuration files and allows the user to add or delete entries. Like normal configuration options, the `[servers]` section in the `gdm.conf-custom` file overrides values in the `gdm.conf` file.

##### [servers]

<display number>

      0=Standard

  Control section for local displays. Each line indicates the local display number and the command that needs to be run to start the X server(s).

  The command can either be a path to an X executable, or a name of one of the server definitions. This can be followed by some arguments that should be passed to the X server when executed. The gdm daemon doesn't enforce the numbers to be in order or for them to be "packed". They keyword "inactive" can be used instead of a command to specify that the display should be not managed. This can be used in the `gdm.conf-custom` to turn off a display that is defined in the `gdm.conf` file.

  GDM will splice "`-auth <ServAuthDir>/:n.Xauth :n`", where n is the display number. Inside the command line before all other arguments before running the X server.

  On some systems it is necessary for GDM to know on which virtual consoles to run the X server. In this case, (if running XFree86) add "vt7" to the command line, for example, to run on virtual console 7. However on Linux and FreeBSD this is normally done automatically if the `VTAllocation` key is set.

  Normally you do not need to add a `-nolisten tcp` flag as this is added automatically for local X servers when the `DisallowTCP` option is set.

priority

      priority=0

  Indicates that the X server should be started at a different process priority. Values can be any integer value accepted by the setpriority C library function (normally between -20 and 20) with 0 being the default. For highly interactive applications, -5 yields good responsiveness. The default value is 0 and the setpriority function is not called if the value is 0.

### Per User Configuration

There are some per user configuration settings that control how GDM behaves. GDM is picky about the file ownership and permissions of the user files it will access, and will ignore files if they are not owned by the user or files that have group/world write permission. It will also ignore the user if the user's $HOME directory is not owned by the user or if the user's $HOME directory has group/world write permission. files must also be smaller than the `UserMaxFile` value as defined in the GDM configuration. If it seems that GDM is not properly accessing user configuration settings, the problem is most likely caused by one of these checks failing.

First there is the `~/.dmrc` file. In theory this file should be shared between GDM and KDM, so users only have to configure things once. This is a standard `.ini` style configuration file. It has one section called `[Desktop]` which has two keys: `Session` and `Language`.

The `Session` key specifies the basename of the session `.desktop` file that the user wishes to normally use (without the `.desktop` extension, in other words). The `Language` key specifies the language that the user wishes to use by default. If either of these keys is missing, the system default is used. The file would normally look as follows:

    [Desktop]
    Session=gnome
    Language=cs_CZ.UTF-8

Normally GDM will write this file when the user logs in for the first time, and rewrite it if the user chooses to change their default values on a subsequent login.

If the GDM Face Browser is turned, then the file `$HOME/.face` is accessed. This file should be a standard image that GTK+ can read, such as PNG or JPEG. It also must be smaller than the `MaxIconWidth` and `MaxIconHeight` values defined in the GDM configuration or it will be ignored. Users can run the `gdmphotosetup` program to specify a face image and it will copy the file to the $HOME/.face location and scale it so its longest dimension is not larger than the `MaxIconWidth` or `MaxIconHeight` values. `gdmphotosetup` takes care to not change the aspect ratio of the image.

Face images can also be placed in the global face directory, which is specified by the `GlobalFaceDir` configuration option ( normally `<share>/pixmaps/faces/`) and the filename should be the name of the user, optionally with a `.png`, `.jpg`, etc. appended.

## Controlling GDM

You can control GDM behavior during runtime in several different ways. You can either run certain commands, or you can talk to GDM using either a unix socket protocol, or a FIFO protocol.

### Comandos

To stop GDM, you can either send the TERM signal to the main daemon or run the `gdm-stop` command which is in the `<sbin>/` directory. To restart GDM, you can either send the HUP signal to the main daemon or run the `gdm-restart` command which is also in the `<sbin>/` directory. To restart GDM but only after all the users have logged out, you can either send the USR1 signal to the main daemon or run the `gdm-safe-restart` command which is in the `<sbin>/` directory as well.

The `gdmflexiserver` command can be used to start new flexible (on demand) displays if your system supports virtual terminals. This command will normally lock the current session with a screensaver so that the user can safely walk away from the computer and let someone else log in. If more that two flexible displays have started `gdmflexiserver` will display a pop-up dialog allowing the user to select which session to continue. The user will normally have to enter a password to return to the session. On session exit the system will return to the previous virtual terminal. Run `gdmflexiserver --help` to get a listing of possible options.

### The FIFO protocol

GDM also provides a FIFO called `.gdmfifo` in the `ServAuthDir` directory (usually `<var>/gdm/.gdmfifo`). You must be root to use this protocol, and it is mostly used for internal GDM chatter. It is a very simple protocol where you just echo a command on a single line to this file. It can be used to tell GDM things such as restart, suspend the computer, or restart all X servers next time it has a chance (which would be useful from an X configuration application).

Full and up to date documentation of the commands and their use is contained in the GDM source tree in the file `daemon/gdm.h`. Look for the defines starting with `GDM_SOP_`. The commands which require the pid of the slave as an argument are the ones that are really used for internal communication of the slave with the master and should not be used.

### Socket Protocol

GDM provides a unix domain socket for communication at `/tmp/.gdm_socket`. Using this you can check if GDM is running, the version of the daemon, the current displays that are running and who is logged in on them, and if GDM supports it on your operating system, also the virtual terminals of all the console logins. The `gdmflexiserver` command uses this protocol, for example, to launch flexible (on-demand) displays.

gdmflexiserver accepts the following commands with the --command option:

    VERSION
    AUTH_LOCAL
    FLEXI_XSERVER
    FLEXI_XNEST
    ATTACHED_SERVERS
    ALL_SERVERS
    GET_SERVER_LIST
    GET_SERVER_DETAILS
    GET_CONFIG
    GET_CONFIG_FILE
    UPDATE_CONFIG
    GREETERPIDS
    QUERY_LOGOUT_ACTION
    SET_LOGOUT_ACTION
    SET_SAFE_LOGOUT_ACTION
    QUERY_VT
    SET_VT
    CLOSE

These are described in detail below, including required arguments, response format, and return codes.

#### VERSION

    VERSION: Query GDM version
    Supported since: 2.2.4.0
    Arguments: None
    Answers:
      GDM <gdm version>
      ERROR <err number> <english error description>
         200 = Too many messages
         999 = Unknown error

#### AUTH_LOCAL

    AUTH_LOCAL: Setup this connection as authenticated for
                FLEXI_SERVER.  Because all full blown (non-Xnest)
                displays can be started only from users logged in
                locally, and here GDM assumes only users logged
                in from GDM.  They must pass the xauth
                MIT-MAGIC-COOKIE-1 that they were passed before
                the connection is authenticated.
    Note:       The AUTH LOCAL command requires the
                --authenticate option, although only
                FLEXI XSERVER uses this currently.
    Note:       Since 2.6.0.6 you can also use a global
                <ServAuthDir>/.cookie, which works for all
                authentication except for SET_LOGOUT_ACTION and
                QUERY_LOGOUT_ACTION and SET_SAFE_LOGOUT_ACTION
                which require a logged in display.
    Supported since: 2.2.4.0
    Arguments: <xauth cookie>
      <xauth cookie> is in hex form with no 0x prefix
    Answers:
      OK
      ERROR <err number> <english error description>
         0 = Not implemented
         100 = Not authenticated
         200 = Too many messages
         999 = Unknown error

#### FLEXI_XSERVER

    FLEXI_XSERVER: Start a new X flexible display.  Only supported on
                   connection that passed AUTH_LOCAL
    Supported since: 2.2.4.0
    Arguments: <xserver type>
      If no arguments, starts the standard X server
    Answers:
      OK <display>
      ERROR <err number> <english error description>
         0 = Not implemented
         1 = No more flexi servers
         2 = Startup errors
         3 = X failed
         4 = X too busy
         6 = No server binary
         100 = Not authenticated
         200 = Too many messages
         999 = Unknown error

#### FLEXI_XNEST

    FLEXI_XNEXT: Start a new flexible Xnest display.
    Note:        Supported on older version from 2.2.4.0, later
                 2.2.4.2, but since 2.3.90.4 you must supply 4
                 arguments or ERROR 100 will be returned.  This
                 will start Xnest using the XAUTHORITY file
                 supplied and as the uid same as the owner of
                 that file (and same as you supply).  You must
                 also supply the cookie as the third argument
                 for this display, to prove that you indeed are
                 this user.  Also this file must be readable
                 ONLY by this user, that is have a mode of 0600.
                 If this all is not met, ERROR 100 is returned.
    Note:        The cookie should be the MIT-MAGIC-COOKIE-1,
                 the first one GDM can find in the XAUTHORITY
                 file for this display.  If that's not what you
                 use you should generate one first.  The cookie
                 should be in hex form.
    Supported since: 2.3.90.4
    Arguments: <display to run on> <uid of requesting user>
               <xauth cookie for the display> <xauth file>
    Answers:
      OK <display>
      ERROR <err number> <english error description>
         0 = Not implemented
         1 = No more flexi servers
         2 = Startup errors
         3 = X failed
         4 = X too busy
         5 = Xnest can't connect
         6 = No server binary
         100 = Not authenticated
         200 = Too many messages
         999 = Unknown error

#### ADD_DYNAMIC_DISPLAY

    ADD_DYNAMIC_DISPLAY: Create a new server definition that will
                         run on the specified display leaving, it
                         in DISPLAY_CONFIG state.
    Supported since: 2.8.0.0
    Arguments: <display to run on>=<server>
      Where <server> is either a configuration named in the
      GDM configuration or a literal command name.
    Answers:
      OK <display>
      ERROR <err number> <english error description>
         0 = Not implemented
         2 = Existing display
         3 = No server string
         4 = Display startup failure
         100 = Not authenticated
         200 = Dynamic Displays not allowed
         999 = Unknown error

#### RELEASE_DYNAMIC_DISPLAYS

    RELEASE_DYNAMIC_DISPLAYS: Release dynamic displays currently in
                              DISPLAY_CONFIG state
    Supported since: 2.8.0.0
    Arguments: None
    Answers:
      OK <display>
      ERROR <err number> <english error description>
         0 = Not implemented
         100 = Not authenticated
         200 = Dynamic Displays not allowed
         999 = Unknown error

#### REMOVE_DYNAMIC_DISPLAY

    REMOVE_DYNAMIC_DISPLAY: Remove a dynamic display, killing the server
                            and purging the display configuration
    Supported since: 2.8.0.0
    Arguments: <display to remove>
    Answers:
      OK <display>
      ERROR <err number> <english error description>
         0 = Not implemented
         1 = Bad display number
         100 = Not authenticated
         200 = Dynamic Displays not allowed
         999 = Unknown error

#### ATTACHED_SERVERS

    ATTACHED_SERVERS: List all attached displays.  Doesn't list XDMCP
                      and xnest non-attached displays.
    Note:             This command used to be named CONSOLE_SERVERS,
                      which is still recognized for backwards
                      compatibility. The optional pattern argument
                      is supported as of version 2.8.0.0.
    Supported since: 2.2.4.0
    Arguments: <pattern> (optional)
      With no argument, all attached displays are returned. The optional
      <pattern> is a string that may contain glob characters '*', '?', and
      '[]'. Only displays that match the pattern will be returned.
    Answers:
      OK <server>;<server>;...

      <server> is <display>,<logged in user>,<vt or xnest display>

      <logged in user> can be empty in case no one logged
      in yet, and <vt> can be -1 if it's not known or not
      supported (on non-Linux for example).  If the display is an
      xnest display and is a console one (that is, it is an xnest
      inside another console display) it is listed and instead of
      vt, it lists the parent display in standard form.

      ERROR <err number> <english error description>
         1 = Not implemented
         200 = Too many messages
         999 = Unknown error

#### ALL_SERVERS

    ALL_SERVERS: List all displays, including console, remote, xnest.
                 This can, for example, be useful to figure out if
                 the display you are on is managed by the gdm daemon,
                 by seeing if it is in the list.  It is also somewhat
                 like the 'w' command but for graphical sessions.
    Supported since: 2.4.2.96
    Arguments: None
    Answers:
      OK <server>;<server>;...

      <server> is <display>,<logged in user>

      <logged in user> can be empty in case no one logged in yet

      ERROR <err number> <english error description>
         0 = Not implemented
         200 = Too many messages
         999 = Unknown error

#### GET_SERVER_LIST

    GET_SERVER_LIST:  Get a list of the server sections from
                      the configuration file.
    Supported since: 2.13.0.4
    Arguments: None
    Answers:
      OK <value>;<value>;...
      ERROR <err number> <english error description>
         0 = Not implemented
         1 = No servers found
         50 = Unsupported key
         200 = Too many messages
         999 = Unknown error

#### GET_SERVER_DETAILS

    GET_SERVER_DETAILS:  Get detail information for a specific server.
    Supported since: 2.13.0.4
    Arguments: <server> <key>
      Key values include:
        NAME      - Returns the server name
        COMMAND   - Returns the server command
        FLEXIBLE  - Returns "true" if flexible, "false"
                    otherwise
        CHOOSABLE - Returns "true" if choosable, "false"
                    otherwise
        HANDLED   - Returns "true" if handled, "false"
                    otherwise
        CHOOSER   - Returns "true" if chooser, "false"
                    otherwise
        PRIORITY  - Returns process priority
    Answers:
      OK <value>
      ERROR <err number> <english error description>
         0 = Not implemented
         1 = Server not found
         2 = Key not valid
         50 = Unsupported key
         200 = Too many messages
         999 = Unknown error

#### GET_CONFIG

    GET_CONFIG:  Get configuration value for key.  Useful so
                 that other applications can request configuration
                 information from GDM.  Any key defined as GDM_KEY_*
                 in gdm.h is supported.  Starting with version 2.13.0.2
                 translated keys (such as "greeter/GdmWelcome[cs]" are
                 supported via GET_CONFIG.  Also starting with version
                 2.13.0.2 it is no longer necessary to include the
                 default value (i.e. you can use key "greeter/IncludeAll"
                 instead of having to use "greeter/IncludeAll=false".
    Supported since: 2.6.0.9
    Arguments: <key>
    Answers:
      OK <value>
      ERROR <err number> <english error description>
         0 = Not implemented
         50 = Unsupported key
         200 = Too many messages
         999 = Unknown error

#### GET_CONFIG_FILE

    GET_CONFIG_FILE:  Get config file location being used by
                      the daemon.  If the GDM daemon was started
                      with the --config option, it will return
                      the value passed in via the argument.
    Supported since: 2.8.0.2
    Arguments: None
    Answers:
      OK <full path to GDM configuration file>
      ERROR <err number> <english error description>
         0 = Not implemented
         200 = Too many messages
         999 = Unknown error

#### UPDATE_CONFIG

    UPDATE_CONFIG: Tell the daemon to re-read a key from the
                   GDM configuration file.   Any user can request
                   that values are re-read but the daemon will
                   only do so if the file has been modified
                   since GDM first read the file.  Only users
                   who can change the GDM configuration file
                   (normally writable only by the root user) can
                   actually modify the GDM configuration.  This
                   command is useful to cause the GDM to update
                   itself to recognize a change made to the GDM
                   configuration file by the root user.

                   Starting with version 2.13.0.0, all GDM keys are
                   supported except for the following:

                          daemon/PidFile
                          daemon/ConsoleNotify
                          daemon/User
                          daemon/Group
                          daemon/LogDir
                          daemon/ServAuthDir
                          daemon/UserAuthDir
                          daemon/UserAuthFile
                          daemon/UserAuthFBDir

                   GDM also supports the following Psuedokeys:

                   xdmcp/PARAMETERS (2.3.90.2) updates the following:
                          xdmcp/MaxPending
                          xdmcp/MaxSessions
                          xdmcp/MaxWait
                          xdmcp/DisplaysPerHost
                          xdmcp/HonorIndirect
                          xdmcp/MaxPendingIndirect
                          xdmcp/MaxWaitIndirect
                          xdmcp/PingIntervalSeconds (only affects new connections)

                    xservers/PARAMETERS (2.13.0.4) updates the following:
                          all [server-foo] sections.

                    Supported keys for previous versions of GDM:

                          security/AllowRoot (2.3.90.2)
                          security/AllowRemoteRoot (2.3.90.2)
                          security/AllowRemoteAutoLogin (2.3.90.2)
                          security/RetryDelay (2.3.90.2)
                          security/DisallowTCP (2.4.2.0)
                          daemon/Greeter (2.3.90.2)
                          daemon/RemoteGreeter (2.3.90.2)
                          xdmcp/Enable (2.3.90.2)
                          xdmcp/Port (2.3.90.2)
                          daemon/TimedLogin (2.3.90.3)
                          daemon/TimedLoginEnable (2.3.90.3)
                          daemon/TimedLoginDelay (2.3.90.3)
                          greeter/SystemMenu (2.3.90.3)
                          greeter/ConfigAvailable (2.3.90.3)
                          greeter/ChooserButton (2.4.2.0)
                          greeter/SoundOnLoginFile (2.5.90.0)
                          daemon/AddGtkModules (2.5.90.0)
                          daemon/GtkModulesList (2.5.90.0)
    Supported since: 2.3.90.2
    Arguments: <key>
      <key> is just the base part of the key such as
      "security/AllowRemoteRoot"
    Answers:
      OK
      ERROR <err number> <english error description>
         0 = Not implemented
         50 = Unsupported key
         200 = Too many messages
         999 = Unknown error

#### GREETERPIDS

    GREETERPIDS: List all greeter pids so that one can send HUP
                 to them for config rereading.  Of course one
                 must be root to do that.
    Supported since: 2.3.90.2
    Arguments: None
    Answers:
      OK <pid>;<pid>;...
      ERROR <err number> <english error description>
         0 = Not implemented
         200 = Too many messages
         999 = Unknown error

#### QUERY_LOGOUT_ACTION

    QUERY_LOGOUT_ACTION: Query which logout actions are possible
                         Only supported on connections that passed
                         AUTH_LOCAL.
    Supported since: 2.5.90.0
    Answers:
      OK <action>;<action>;...
         Where action is one of HALT, REBOOT or SUSPEND.  An
         empty list can also be returned if no action is possible.
         A '!' is appended to an action if it was already set with
         SET_LOGOUT_ACTION or SET_SAFE_LOGOUT_ACTION.  Note that
         SET_LOGOUT_ACTION has precedence over
         SET_SAFE_LOGOUT_ACTION.
      ERROR <err number> <english error description>
         0 = Not implemented
         100 = Not authenticated
         200 = Too many messages
         999 = Unknown error

#### SET_LOGOUT_ACTION

    SET_LOGOUT_ACTION: Tell the daemon to halt/restart/suspend after
                       slave process exits.  Only supported on
                       connections that passed AUTH_LOCAL.
    Supported since: 2.5.90.0
    Arguments: <action>
      NONE           Set exit action to 'none'
      HALT           Set exit action to 'halt'
      REBOOT         Set exit action to 'reboot'
      SUSPEND        Set exit action to 'suspend'
    Answers:
      OK
      ERROR <err number> <english error description>
         0 = Not implemented
         7 = Unknown logout action, or not available
         100 = Not authenticated
         200 = Too many messages
         999 = Unknown error

#### SET_SAFE_LOGOUT_ACTION

    SET_SAFE_LOGOUT_ACTION:  Tell the daemon to halt/restart/suspend
                             after everybody logs out.  If only one
                             person logs out, then this is obviously
                             the same as the SET_LOGOUT_ACTION.  Note
                             that SET_LOGOUT_ACTION has precedence
                             over SET_SAFE_LOGOUT_ACTION if it is set
                             to something other then NONE.  If no one
                             is logged in, then the action takes effect
                             effect immediately.  Only supported on
                             connections that passed AUTH_LOCAL.
    Supported since: 2.5.90.0
    Arguments: <action>
      NONE           Set exit action to 'none'
      HALT           Set exit action to 'halt'
      REBOOT         Set exit action to 'reboot'
      SUSPEND        Set exit action to 'suspend'
    Answers:
      OK
      ERROR <err number> <english error description>
         0 = Not implemented
         7 = Unknown logout action, or not available
         100 = Not authenticated
         200 = Too many messages
         999 = Unknown error

#### QUERY_VT

    QUERY_VT:  Ask the daemon about which VT we are currently on.
               This is useful for logins which don't own
               /dev/console but are still console logins.  Only
               supported on Linux currently, other places will
               just get ERROR 8.  This is also the way to query
               if VT support is available in the daemon in the
               first place.  Only supported on connections that
               passed AUTH_LOCAL.
    Supported since: 2.5.90.0
    Arguments: None
    Answers:
      OK <vt number>
      ERROR <err number> <english error description>
         0 = Not implemented
         8 = Virtual terminals not supported
         100 = Not authenticated
         200 = Too many messages
         999 = Unknown error

#### SET_VT

    SET_VT:  Change to the specified virtual terminal.
             This is useful for logins which don't own /dev/console
             but are still console logins.  Only supported on Linux
             currently, other places will just get ERROR 8.
             Only supported on connections that passed AUTH_LOCAL.
    Supported since: 2.5.90.0
    Arguments: <vt>
    Answers:
      OK
      ERROR <err number> <english error description>
         0 = Not implemented
         8 = Virtual terminals not supported
         9 = Invalid virtual terminal number
         100 = Not authenticated
         200 = Too many messages
         999 = Unknown error

#### CLOSE

    CLOSE: Close sockets connection
    Supported since: 2.2.4.0
    Arguments: None
    Answers: None

## GDM Commands

### GDM User Commands

The GDM package provides the following different commands in EXPANDED_BINDIR intended to be used by the end-user:

#### `gdmXnestchooser` and `gdmXnest` Command Line Options

The `gdmXnestchooser` command automatically gets the correct display number, sets up access, and runs `Xnest` with -indirect localhost. This way you get an XDMCP chooser provided by your computer. You can also supply as an argument the hostname whose chooser should be displayed, so `gdmXnestchooser somehost` will run the XDMCP chooser from host `somehost` inside an Xnest session. You can make this command do a direct query instead by passing the `-d` option as well. In addition to the following options, this command also supports standard GNOME options.

##### `gdmXnestchooser` Command Line Options

-x, --xnest=STRING

  Xnest command line, default is "Xnest"

-o, --xnest-extra-options=OPTIONS

  Extra options for Xnest, default is no options.

-n, --no-query

  Just run Xnest, no query (no chooser)

-d, --direct

  Do direct query instead of indirect (chooser)

-B, --broadcast

  Run broadcast instead of indirect (chooser)

-b, --background

  Run in background

--no-gdm-check

  Don't check for running GDM

#### `gdmflexichooser` Command Line Options

The `gdmflexiserver` command provides three features. It can be used to run flexible (on demand) X displays, to run a flexible display via Xnest, and to send commands to the GDM daemon process.

Starting a flexible X display will normally lock the current session with a screensaver and will redisplay the GDM login screen so a second user can log in. This feature is only available on systems that support virtual terminals and have them enabled. This feature is useful if you are logged in as user A, and user B wants to log in quickly but user A does not wish to log out. The X server takes care of the virtual terminal switching so it works transparently. If there is more than one running display defined with flexible=true, then the user is shown a dialog that displays the currently running sessions. The user can then pick which session to continue and will normally have to enter the password to unlock the screen.

Flexible displays started via Xnest works on systems that do not support virtual terminals. This option starts a flexible display in a window in the current session. This does not lock the current session, so is not as secure as a flexible server started via virtual terminals.

The `gdmflexiserver --command` option provides a way to send commands to the GDM daemon and can be used to debug problems or to change the GDM configuration.

In addition to the following options, `gdmflexiserver` also supports standard GNOME options.

##### `gdmflexichooser` Command Line Options

-c, --command=COMMAND

  Enviar el comando de protocolo especificado a GDM

-n, --xnest

  Start a flexible X display in Xnest mode

-l, --no-lock

  No bloquear la pantalla actual

-d, --debug

  Activar salida de depuración para enviarla a syslog. Lo mismo que cuadno se activa la depuración en el archivo de configuración.

-a, --authenticate

  Autenticar antes de ejecutar --command

-s, --startnew

  Starts a new flexible display without displaying a dialog asking the user if they wish to continue any existing sessions.

#### Opciones de línea de comandos de `gdmdynamic`

The `gdmdynamic` command which creates, runs, and removes displays (X servers) on demand.

Some environments need the ability to tell GDM to create and manage new displays on the fly, where it is not possible to list the possible displays in GDM configuration files. The `gdmdynamic` command can be used to create a new display on a particular display number, run all newly created displays, or remove a display. The `gdmdynamic` command can also be used to list all attached displays, or only attached displays that match a pattern.

##### Opciones de línea de comandos de `gdmdynamic`

  Una de las siguientes opciones pueden usarse por instancia:

-a display=server

  Add a new display configuration. For example, `"-a 2=StandardServerTwo"``"-a 3=/usr/X11R6/bin/X -dev /dev/fb2"`

-r

  Release (run) all displays waiting in the DISPLAY_CONFIG state.

-d display

  Delete a display, killing the X server and purging the display configuration. For example, "-d 3".

-l [pattern]

  List displays via the ATTACHED_SERVERS command. Without a pattern lists all attached displays. With a pattern will match using glob characters '*', '?', and '[]'. For example: `"-l Standard*"``"-l *Xorg*"`

  These options can be added to the above:

-v

  Verbose mode. Prinr diagnostic messages about each message sent to GDM.

-b

  Background mode. Fork child to do the work and return immediately.

#### `gdmphotosetup` Command Line Options

Allows the user to select an image that will be used as the user's photo by GDM's face browser, if enabled by GDM. The selected file is stored as ~/.face. This command accepts standard GNOME options.

#### `gdmthemetester` Command Line Options

`gdmthemetester` takes two parameters. The first parameter specifies the environment and the second parameter specifies the path name or the name of a theme to view. This is a tool for viewing a theme outside of GDM. It is useful for testing or viewing themes. `gdmthemetester` requires that the system support `gdmXnest`. Note that themes can display differently depending on the theme's "Show mode". `gdmthemetester` allows viewing the themes in different modes via the environment option. Valid environment values and their meanings follow:

    console       - In console mode.
    console-timed - In console non-flexi mode.
    flexi         - In flexi mode.
    xdmcp         - In remote (XDMCP) mode.
    remote-flexi  - In remote (XDMCP) & flexi mode.

### GDM Root User Commands

The GDM package provides the following different commands in EXPANDED_SBINDIR intended to be used by the root user:

#### `gdm` and `gdm-binary` Command Line Options

The `gdm` command is really just a script which runs the `gdm-binary`, passing along any options. Before launching `gdm-binary`, the gdm wrapper script will source the `<etc>/profile` file to set the standard system environment variables. In order to better support internationalization, it will also set the LC_MESSAGES environment variable to LANG if neither LC_MESSAGES or LC_ALL are set. If you really need to set some additional environment before launching GDM, you can do so in this script.

##### `gdm` and `gdm-binary` Command Line Options

--help

  Gives a brief overview of the command line options.

-nodaemon

  If this option is specified, then GDM does not fork into the background when run. You can use just a single dash with this option to preserve compatibility with XDM.

--no-console

  Tell the daemon that it should not run anything on the console. This means that none of the local servers from the `[servers]` section will be run, and the console will not be used for communicating errors to the user. An empty `[servers]` section automatically implies this option.

--config=CONFIGFILE

  Specify an alternative configuration file.

--preserve-ld-vars

  When clearing the environment internally, preserve all variables starting with LD_. This is mostly for debugging purposes.

--version

  Print the version of the GDM daemon.

--wait-for-go

  If started with this option, gdm will init, but only start the first local display and then wait for a GO message in the fifo protocol. No greeter will be shown until the GO message is sent. Also flexiserver requests will be denied and XDMCP will not be started until GO is given. This is useful for initialization scripts which wish to start X early, but where you don't yet want the user to start logging in. So the script would send the GO to the fifo once it is ready and GDM will then continue. This functionality was added in version 2.5.90.0.

#### `gdmsetup` Command Line Options

`gdmsetup` runs a graphical application for modifying the GDM configuration file. Normally on systems that support the PAM userhelper, this is setup such that when you run `gdmsetup` as an ordinary user, it will first ask you for your root password before starting. Otherwise, this application may only be run as root. This application supports standard GNOME options.

#### `gdm-restart` Command Line Options

`gdm-restart` stops and restarts GDM by sending the GDM daemon a HUP signal. This command will immediately terminate all sessions and log out users currently logged in with GDM.

#### `gdm-safe-restart` Command Line Options

`gdm-safe-restart` stops and restarts GDM by sending the GDM daemon a USR1 signal. GDM will be restarted as soon as all users log out.

#### `gdm-stop` Command Line Options

`gdm-stop` stops GDM by sending the GDM daemon a TERM signal.

### Comandos internos de GDM

The GDM package provides the following different commands in EXPANDED_LIBEXECDIR intended to be used by the gdm daemon process.

#### `gdmchooser` and `gdmlogin` Command Line Options

The `gdmgreeter` and `gdmlogin` are two different login applications, either can be used by GDM. `gdmgreeter` is themeable with GDM themes while `gdmlogin` is themable with GTK+ themes. These applications are normally executed by the GDM daemon. Both commands support standard GNOME options.

#### `gdmchooser` Command Line Options

The `gdmchooser` is the XDMCP chooser application. The `gdmchooser` is normally executed by the GDM daemon. It supports the following options for XDM compatibility. This command supports standard GNOME options and is found in support standard GNOME options.

##### `gdmchooser` Command Line Options

-xdmaddress=SOCKET

  Socket for XDM communication.

--clientaddress=ADDRESS

  Client address to return in response to XDM. This option is for running gdmchooser with XDM, and is not used within GDM.

-connectionType=TYPE

  Connection type to return in response to XDM. This option is for running gdmchooser with XDM, and is not used within GDM.

#### `gdm-ssh-session`

The `gdm-ssh-session` is normally executed by the GDM daemon when starting a securte remote connection through ssh. It does not take any options.

## Interfaz con temas

This section describes the creation of themes for the Themed Greeter. For examples including screenshots, see the standard installed themes and the themes from the theme website.

### Descripción de los temas

GDM Themes can be created by creating an XML file that follows the specification in gui/greeter/greeter.dtd. Theme files are stored in the directory `<share>/gdm/themes/<theme_name>`. Usually this would be under `/usr/share`. The theme directory should contain a file called `GdmGreeterTheme.desktop` which has similar format to other .desktop files and looks like:

    [GdmGreeterTheme]
    Encoding=UTF-8
    Greeter=circles.xml
    Name=Circles
    Description=Theme with blue circles
    Author=Bond, James Bond
    Copyright=(c) 2002 Bond, James Bond
    Screenshot=screenshot.png

The Name, Description, Author and Copyright fields can be translated just like the other `.desktop`files. All the files that are mentioned should be in the theme directory itself. The Screenshot field points to a file which should be a 200x150 screenshot of the theme in action (it is OK not to have one, but it makes it nicer for user). The Greeter field points to an XML file that contains the description of the theme. The description will be given later.

Once you have theme ready and installed you can test it with the installed `gdmthemetester` script. This script assumes that the X server supports Xnest. This command takes two arguments, first the environment that should be used. This is one of console, console-timed, flexi, remote-flexi, xdmcp. Where console is a standard console login, console-timed is a console login with a timed login going on, flexi is for any local flexible display, remote-flexi is for flexi displays that are not local (such as an Xnest flexiserver run from a remote display) and xdmcp is for remote XDMCP connections. The second argument is the theme name. So for example to test how things look in the XDMCP mode with the circles theme you would run:

    gdmthemetester xdmcp circles

Be sure to test all the environments with your theme, and make sure to test how the caps lock warning looks by pressing caps lock. This is also a good way to take screenshots, just take a screenshot of the Xnest window. This can be done in GNOME by focusing the Xnest window and pressing Alt-PrintScreen.

Once you have all this done, then make a tarball that contains the directory name (so that you could just untar it in the `/usr/share/gdm/themes` directory). And this is the tarball you distribute and people can install from the graphical configuration application. You can do this with the commands:

    cd /usr/share/gdm/themes
    tar czvf <theme_name>.tar.gz <theme_name>/

### Detailed Description of Theme XML format

#### Box Nodes

Box nodes are container nodes for item nodes. Box nodes are specified as follows:

    <box orientation="alignment" min-width="num"
    xpadding="num" ypadding="num" spacing="num"
    homogeneous="bool">

Where "num" means number and bool means either "true" or "false" The alignment value can be either "horizontal" or "vertical". If you leave any property off it will default to zero or "false" in case of "homogeneous" and "vertical" for the orientation.

If the box is homogeneous then the children are allocated equal amount of space.

The "min-width" must be specified in pixels. Obviously there is also a corresponding "min-height" property as well.

#### Fixed Nodes

Fixed is a container that has its children scattered about laid out with precise coordinates. The size of this container is the biggest rectangle that contains all the children. Fixed has no extra properties and so you just use:

    <fixed>

Then you put other items with proper position nodes inside this.

The "toplevel" node is really just like a fixed node.

#### Item Nodes

A GDM Theme is created by specifying a hierarchy of item and box nodes. Item nodes can have the following value for "type":

entrada

  Campo de entrada de texto.

lista

  Un widget de lista

etiqueta

  A text label. Must have a "text" node to specify the text.

imagen

  An pixmap image in a format that gdk-pixbuf supports like PNG, JPEG, Tiff, etc...)

rect

  Rectángulo.

svg

  Imagen Scaled Vector Graphic

For example:

    <item type="label">

Items can specify ID values which gives them a specific look and feel or formatting. Furthermore you can customize the login process by adding custom widgets with custom id's for some items (currently only the list item)

Entry items can have id values as follows:

user-pw-entry

  Entry field for userid and password entry. This is the field used for responses for the PAM/GDM questions (Username, Password, etc..).

List items can have id values as follows:

lista de usuarios

  A Face Browser list, so that users can pick their username by clicking on this instead of typing.

Furthermore, you can have an arbitrary id (I'd recommend starting the id with 'custom' not to conflict with future additions to this spec) and ask extra information of the user. See the section 'Custom Widgetry'

Label items can have id values as follows:

reloj

  Label that displays the date and time.

pam-prompt

  Label that displays the PAM prompt. This is the prompt that PAM uses to ask for username, password, etc...

pam-error

  Label that displayst PAM/GDM error messages. Such as when user can't log in.

pam-message

  Label that displays the PAM message. These are messages that PAM/GDM gives about state of the account, help about the prompts and other information.

timed-label

  Etiqueta que muestra la información de la entrada temporizada.

Rectangles can have id values as follows:

caps-lock-warning

  Displays an icon that shows if the CAPS LOCK key is depressed. This rectangle will be hidden/shown appropriately

If an item is of type rect, the item can be a button. Buttons must also include a "button" value as follows:

    <item type="rect" id="disconnect_button" button="true">.

Possible values for button ids are as follows:

chooser_button

  Runs the XDMCP chooser.

config_button

  Ejecuta la aplicación de configuración de GDM.

disconnect_button

  Desconectar de una sesión remota.

botón_idioma

  Muestra el diálogo de selección del idioma.

botón_detener

  Halt (shuts down) the system.

botón reiniciar

  Restart the system.

botón_sesión

  List and select from available sessions.

botón_suspender

  Suspender el sistema

botón_sistema

  Perform halt/restart/suspend/etc. options (if allowed by GDM configuration). Also allows user to run configurator if user enters root password (again if allowed by GDM configuration). This is usually now labeled Actions, and referred to as the Actions menu.

#### Position Node

Each item can specify its position and size via the "pos" node. For example:

    <pos x="0" y="4" width="100%" height="100%"/>

Both position and size can be given in percent and it will be taken as the percentage of the size of the current container. For toplevel items it's the percentage of the whole screen.

For x and y, you can also specify a negative position which means position from the right or bottom edge. But this only applies with absolute coordinates. With percentage you can specify negative position and it will be still from the same edge.

The position also specifies the anchor of the item, this can be "n" "ne" "e" "se" "s" "sw" "w" and "nw" or "center" which stand for the different edges/corners or "center" for center. For example:

    <pos x="10%" y="50%" anchor="w" width="80%" height="95"/>

If the item contains a box, you can specify width and height to be "box" to mean that they are supposed to be the width and height of the box, that is the items in the box plus the padding.

If the item contains an SVG image, you can specify width and height to be "scale" to mean that the SVG image should be scaled to fit the requested area.

You can also specify an "expand" property to either be "true" or false. If true then the child will be expanded in the box as much as possible (that is it will be given more space if available).

There are two extra properties you can specify (as of 2.4.4.3) for labels (and labels only). The first is "max-width" which will specify the maximum width of the label in pixels. And the second is "max-screen-percent-width" which specifies the maximum percentage of the screen width that the label can occupy. By default no label will occupy more then 90% of the screen by width. An example may be:

    <item type="label">
    <pos x="10%" max-screen-percent-width="50%"/>

#### Mostrar nodo.

Some items may only display in certain modes, like when doing a remote display. Multiple values can be specified and must be separated with commas. The following values are possible:

`console` - In console mode.

`console-fixed` - In console non-flexi mode.

`console-flexi` - In console & flexi mode.

`flexi` - In flexi mode.

`remote` - In remote mode.

`remote-flexi` - In remote & flexi mode.

For example:

    <show modes="flexi,remote"/>

You can also specify the "type" value to indicate that certain items should only be displayed if the type is true. Valid values include the following:

`chooser`, if ChooserButton is set to "true" in the GDM configuration.

`config`, if ConfigAvailable is set to "true" in the GDM configuration.

`halt`, if HaltDaemon is specified in the GDM configuration.

`reboot`, if RebootCommand is specified in the GDM configuration.

`suspend`, if SuspendCommand is specified in the GDM configuration.

`system`, if SystemMenu is specified in the GDM configuration.

`timed`, if TimedLoginEnabled is set to "true" in the GDM configuration.

For example:

    <show modes="console" type="system"/>

Note that if SystemMenu is off then the halt, restart, suspend, chooser and config choices will not be shown, so this is a global toggle for them all. See some of the standard themes for how the show modes are used.

#### Normal/Active/Prelight Nodes

Depending on the item type (except for userlist - refer to Color node below), it can specify its color, font, or image via the following tags:

`normal` - normal state.

`active` - when the item has active focus.

`prelight` - when the mouse is hovering over the item.

When item is "rect" (alpha can be omitted and defaults to 0.0):

    <normal color="#ffffff" alpha="0.0">

When item is "label"

    <normal color="#ffffff" font="Sans 14"/>

When the item type is "pixmap" or "SVG", then the normal, active, and prelight tags specify the images to use as follows:

    <normal file="picture.png" tint="#dddddd"/>

Note that relative pathnames are assumed to be in the same directory as the theme `.xml` file in `<share>/gdm/themes/<theme_name>`.

#### Face Browser Icon/Label Color Nodes

If the item type is of userlist, then the background color for the icon and label can be set separately via the the following tag:

    <color iconcolor="#dddddd" labelcolor="#ffffff"/>

#### Text Node

Text tags are used by labels. They can be used to display localized text as follows (if the "xml:lang" attribute is omitted, the C locale is assumed):

    <text xml:lang="fr">Option</text>

You can include pango markup in the text nodes for labels, however you must encode it. So for example to have the label of "foo<sup>bar</sup>", you must type:

    <text">foo&lt;sup&>bar&lt;/sup&></text>

Text nodes can contain the following special character sequences which will be translated as follows:

%% - A literal % character

%c - Clock time. Only labels with the "clock" id will update automatically every second. Other labels will contain a static timestamp.

%d - Display name (DISPLAY environment variable)

%h - Hostname (gethostname output)

%m - Machine name (uname.machine output)

%n - Node name (uname.nodename output)

%o - Domain name (getdomainname output)

%r - Release name (uname.release output)

%s - System name (uname.sysname output)

%t - Current timed delay value from configuration file (0 if off) followed by the word "seconds" if value is greater than 1 or the word "second" if the value is 1. This character sequence is intended to be only used internally to display the "timed-label" message, which is automatically updated every second.

%u - Timed username value from configuration file (empty if off) This character sequence is intended to be only used internally to display the "timed-label" message, which is automatically updated every second.

\n - Carriage return

_ - An underscore causes the following character to be underlined. If it precedes a % character sequence, the string that replaces the character sequence is underlined.

#### Stock

Certain common localized labels can be specified via the stock tags. The "text" tag is ignored if the "stock" tag is used. You should really use the stock labels rather then just putting all the translations into the themes. This gives faster load times and likely better translations. The following values are valid:

`cancel`, _("_Cancel"

`caps-lock-warning`, _("Caps Lock key is on."

`chooser`, _("_XDMCP Chooser"

`config`, _("_Configure"

`disconnect`, _("D_isconnect"

`halt`, _("Shut _Down"

`language`, _("_Language"

`ok`, _("_OK"

`quit`, _("_Quit"

`reboot`, _("_Restart"

`session`, _("_Session"

`suspend`, _("Sus_pend"

`system`, _("_Actions" (Formerly "S_ystem"

`timed-label`, _("User %u will login in %t"

`username-label`, _("Username:"

`welcome-label`, _("Welcome to %n"

For example:

    <stock type="welcome-label">

#### Custom Widgetry

Currently there is one item which can be customizable and this is the list item. If you need to ask the user extra things, such as to pick from a list of places to log into, or set of custom login sessions you can setup the list item and add listitem children that describe the choices. Each listitem must have an id and a text child. The choice will be recorded in the file `<ServAuthDir>/<display>.GreeterInfo` as `<list id>=<listitem id>`.

For example suppose we are on display :0, `ServAuthDir` is `<var>/gdm` and we have the following in the theme:

    <item type="list" id="custom-config">
    <pos anchor="nw" x="1" y="1" height="200" width="100">
    <listitem id="foo">
    <text>Foo</text>
    </listitem>
    <listitem id="bar">
    <text>Bar</text>
    </listitem>
    </item>

Then if the user chooses 'Foo' then `<var>/gdm/:0.GreeterInfo` will contain:

    custom-config=foo

## Accesibilidad

GDM supports "Accessible Login" to allow users to log in to their desktop session even if they cannot easily use the screen, mouse, or keyboard in the usual way. This feature allows the user to launch assistive technologies at login time by means of special "gestures" from the standard keyboard and from a keyboard, pointing device, or switch device attached to the USB or PS/2 mouse port. It also allows the user to change the visual appearance of the login UI before logging in, for instance to use a higher-contrast color scheme for better visibility. GDM only supports accessibility with the GTK+ Greeter, so the "Greeter" parameter in the GDM configuration must be set to the GTK+ Greeter "gdmlogin"

### Configuración de accesibilidad

In order to enable Accessible Login, the system administrator must make some changes to the default login configuration by manually modifying three human-readable configuration files, stored in the GDM configuration, AccessKeyMouseEvents and AccessDwellMouseEvents.

In order to allow users to change the color and contrast scheme of the login dialog, make sure the `AllowThemeChange` parameter in the GDM configuration is set to "true".

To restrict user changes to the visual appearance to a subset of available themes, the `GtkThemesToAllow` parameter in the GDM configuration can be set to a list of acceptable themes separated by commas. For example:

    GtkThemesToAllow=HighContrast,HighContrastInverse

To enable the use of assistive technologies such as the Onscreen Keyboard, Screen Reader, or Magnifier, the `AddGtkModules` parameter in the GDM configuration must be uncommented and set to "true". Also the `GtkModulesList` parameter must be uncommented and set as follows:

    GtkModulesList=gail:atk-bridge:dwellmouselistener:keymouselistener

System administrators may wish to load only the minimum subset of these modules which is required to support their user base. Depending on the end-user needs, not all of the above GtkModules may need to be loaded. If your end-users need the integrated Screen Reader and Magnifier, you must include "gail" and "atk-bridge". If your end-users will be using a pointing device without buttons or switches, include "dwellmouselistener". If some of your users will use pointing devices with switches, alternative physical keyboards, or switch/button devices, include "keymouselistener". Including all four is suitable for most system configurations. The Onscreen Keyboard can operate without gail and atk-bridge, but with a reduced feature set; for optimum accessibility we recommend including both gail and atk-bridge.

Once "keymouselistener" and/or "dwellmouselistener" have been added to the GtkModules loaded by GDM, you can assign end-user actions with the launching of specific assistive technologies. These gesture associations are contained in files AccessKeyMouseEvents and AccessDwellMouseEvents, respectively. Both files are located in the <etc>/gdm/modules directory. The gesture format is described in the two configuration files.

The AccessKeyMouseEvents file controls the keymouselistener Gesture Listener and is used to define key-press, mouse button, or XInput device sequences that can be used to launch applications needed for accessibility. In order to reduce the likelihood of unintentional launch, these "gestures" may be associated with multiple switch presses and/or minimum durations.

The DwellKeyMouseEvents file controls the dwellmouselistner and supports gestures that involve only motion of a pointing device such as the system mouse of an alternative pointing device such as a head pointer or trackball may also be defined. All gestures are specified by the same syntax; that is, there is no distinction between a "core mouse" gesture and motion from an alternate input device.

Motion gestures are defined as "crossing events" into and out of the login dialog window. If the "dwellmouselistener" GtkModule is loaded, alternative pointing devices are temporarily "latched" to the core pointer, such that motion from alternative devices results in movement of the onscreen pointer.

In order to use text-to-speech services at login time (for instance, when using the Screen Reader in speech mode) on some operating systems, the GDM user must be made a member of the "audio" group

Currently GDM does not remember what accessible technology programs have been started when switching applications. So if the user switches between the login program and the chooser, for example, then it is necessary for the user to redo the gesture. Users may need to also set up their default session so that the assistive technologies required are started automatically (or have appropriate key-bindings defined to start them) after the user session has started.

There are some issues that cause users to have problems getting the gesture listeners to work. It is recommended that people use GDM version 2.8.0.5 or later for best results. Some X servers have a bug which causes detectable autorepeat to fail when XEVIE is enabled (which happens when atk-bridge is included as a GTK Module). This bug causes key gestures with a duration greater than 0 to always fail. A workaround is to simply redefine all key gestures so they have zero length duration. Some versions of GOK and gnopernicus will not launch unless the "gdm" user has a writable home directory. If you see an hourglass cursor when you complete a gesture but the program does not start, then you are likely having this problem. It should be considered a bug for AT programs to require having a writable home directory, so please file a bug with the AT program if you encounter this problem. Also note that some input devices require X server configuration before GDM will recognize them.

### Accessibility Login Sound Configuration

By default, GDM requires a media application such as "sox" to be present to play sounds for successful or failed login. GDM defaults the location of this application to `/usr/bin/play` (or `/usr/bin/audioplay` on Solaris. This can be changed via the SoundProgram GDM configuration option. Typically most text-to-speech programs (such as ORCA or Gnopernicus) use a separate mechanism to play audio.

## Características específicas de Solaris

GDM soporta unas pocas características específicas a Solaris, como las siguientes:

GDM soporta Solaris Auditing si se ejecuta sobre Solaris 10 o superior.

GDM supports a security feature which causes the X server to run as the user instead of as the root user. GDM must be using PAM for this feature to be enabled, which is the normal case for Solaris. This second feature has the side-effect of causing the X server to always restart between sessions, which disables the AlwaysRestartServer configuration option.

Solaris supports the `/etc/default/login` interface, which affects the `DefaultPath`, `RootPath`, `PasswordRequired`, and `AllowRemoteRoot` options as described in the Configuration section.

## Configuraciones de ejemplo

Esta sección tiene algunas configuraciones de ejemplo que son útiles para varias configuraciones.

### Terminal Lab With One Server

Suppose you want to make a lab full of X terminals that all connect to one server machine. So let's call one X terminal `xterminal` and let's call the server machine `appserver`. You install GDM on both.

On `appserver` you enable XDMCP, so you have

    [xdmcp]
    Enable=true

If you want no local screens here, you can then make the `[servers]` section empty.

On the `xterminal` you disable XDMCP (you don't want anyone to connect to the xterminal really). You will add a server type perhaps called `Terminal` as follows:

    [server-Terminal]
    name=Terminal server
    command=/usr/X11R6/bin/X -terminate
    flexible=false
    handled=false

This definition should in fact be included in the standard configuration file. Notice that we made the `handled` key false since we don't want GDM to handle this server localy. Also note that we have not yet added the `-query` argument, you can add that here, or in the `[servers]` section. We'll define our local servers as follows:

    [servers]
    0=Terminal -query appserver

This will run a direct XDMCP query to the server named `appserver`.

### Terminal Lab With Two Or More Servers

Suppose you want to make a lab full of X terminals that all connect to some choice of servers. For now let's make it `appserverone` and `appservertwo`. Again we'll call our example X terminal server `xterminal`. The setup on both servers is the same as with the case of one server in the previous section. You do not need to explicitly enable indirect queries on the server since we'll run the choosers locally on the X terminals.

So on the `xterminal` you again disable XDMCP. You will add a server type perhaps called `Chooser` as follows:

    [server-Chooser]
    name=Chooser server
    command=/usr/X11R6/bin/X
    flexible=false
    chooser=true

And again this definition should in fact be included in the standard configuration file. Notice that we made the `chooser` key true here. This will run the XDMCP chooser for this server, and when the user chooses a host GDM will run a query for that host. Then we will define our local servers as follows:

    [servers]
    0=Chooser

The XDMCP chooser on the X terminal will normally give a broadcast query to see which servers exist on the network. If the two servers are not reachable by a broadcast query, you must add them by hand to the configuration file. So in the `[chooser]` section you would have:

    Hosts=appserverone,appservertwo

and any other servers you wish the users to be able to connect to.

Sometimes you may want to run the chooser on the server side however. Then what you want to do is to run a configuration similar to the previous section about the one server configuration with XDMCP indirect queries enabled on `appserver` and on the X terminals you'd have

    [servers]
    0=Terminal -indirect appserver

This way for example you only have to maintain one `Hosts` entry. However as a disadvantage then, the `appserver` must then always be available. So it's not good for situations where you want to have serveral servers and not all of them have to be on all the time. You could also have one of the X terminals handle indirect XDMCP queries and serve up the chooser to the other X terminals.

## License

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

A copy of the GNU General Public License is included as an appendix to the GNOME Users Guide. You may also obtain a copy of the GNU General Public License from the Free Software Foundation by visiting their Web site or by writing to

     Free Software Foundation, Inc. 59 Temple Place - Suite 330 Boston, MA02111-1307USA