0.0 2008-09 GDM 是 GNOME 显示管理器，一个图形界面的登录程序。 MartinK. Petersen

mkp@mkp.net

GeorgeLebl

jirka@5z.com

JonMcCann

mccann@jhu.edu

RayStrode

rstrode@redhat.com

BrianCameron

Brian.Cameron@Oracle.COM

1998 1999 Martin K. Petersen 2001 2003 2004 George Lebl 2003 2007 2008 Red Hat, Inc. 2003 2011 Oracle and/or its affiliates. All rights reserved. 本手册讲述的是 GNOME 显示管理器 2.26.0，它最近更新于 2009年2月10日。 本手册讲述的是 GNOME 显示管理器 2.26.0，它最近更新于 2009年2月10日。 Chooser - A program used to select a remote host for managing a display remotely on the attached display (gdm-host-chooser). FreeDesktop - The organization providing desktop standards, such as the Desktop Entry Specification used by GDM. http://www.freedesktop.org. GDM - GNOME 显示管理器，用来描述整个软件包。 Greeter - The graphical login window (provided by gnome-shell). PAM - 可插入的认证机制 XDMCP - X 显示管理协议 Xserver - An implementation of the X Window System. For example the Xorg Xserver provided by the X.org Foundation http://www.x.org. Paths that start with a word in angle brackets are relative to the installation prefix. I.e. <share>/pixmaps/ refers to /usr/share/pixmaps if GDM was configured with --prefix=/usr. GNOME 显示管理器 (GDM) 是一个实现了管理本地和远程显示所要求的所有重要功能的显示管理器。GDM 是从头开始编写的，不包含任何 XDM 或 X Consortium 的代码。 注意 GDM 是可以设置的，并且很多配置对安全有影响。用户需要知晓的影响，会在本文档中高亮显示。 请注意，一些操作系统设置 GDM 为不同于本文档中描述的行为。如果 GDM 并不是像叙述的样子，请查看相关的设置是否不同于此处描述的。 For further information about GDM, refer to the project website at http://wiki.gnome.org/Projects/GDM. For discussion or queries about GDM, refer to the discussion forum at https://discourse.gnome.org/tag/gdm. The archives of the previous mailing list are also a good resource to check to seek answers to common questions. The list was archived at https://mail.gnome.org/archives/gdm-list/ and has a search facility to look for messages with keywords. Please submit any bug reports or enhancement requests to https://gitlab.gnome.org/GNOME/gdm/-/issues/. GDM 2.20 和更早的版本支持稳定的配置界面。但是基础代码在 GDM 2.22 重写了，其并不是完全的向后兼容旧版的。部分原因是，工作方式不同了，所以一些选项没有意义了；一部分原因是一些选项从来没有使用过；另外的一部分原因是一些功能还没有重新实现。 Interfaces which continue to be supported in a stable fashion include the Init, PreSession, PostSession, PostLogin, and Xsession scripts. Some daemon configuration options in the <etc>/gdm/custom.conf file continue to be supported. Also, the ~/.dmrc, and face browser image locations are still supported. GDM 2.20 和更早的版本支持多个显卡上的多个显示器管理功能，就像使用终端服务界面，通过像是 Xnest 或 Xephyr 的程序登录一个窗口，gdmsetup 程序，基于 XML 的欢迎界面主题，以及从登录窗口运行 XDMCP chooser 的能力。2.22版重写之后，这些特性没有添加回来。 GDM 负责管理系统上的显示，包括认证用户，开始用户会话，结束用户会话。GDM 是可以配置的，其配置方法在本文档的 “配置 GDM”一节说明。GDM 也适合残障人士。 GDM 提供了管理主控制台显示的能力，且是通过虚拟终端显示。它是和其他程序集成的，例如快速用户切换小程序 (FUSA) 和 gnome-screensaver，以通过 Xserver 虚拟终端 (VT) 接口管理控制台上的多显示。它也可以管理 XDMCP 显示。 Regardless of the display type, GDM will do the following when it manages the display. It will start an Xserver process, then run the Init script as the root user, and start the greeter program on the display. The greeter program is run as the unprivileged "gdm" user/group. This user and group are described in the "Security" section of this document. The main functions of the greeter program are to provide a mechanism for selecting an account for log in and to drive the dialogue between the user and system when authenticating that account. The authentication process is driven by Pluggable Authentication Modules (PAM). The PAM modules determine what prompts (if any) are shown to the user to authenticate. On the average system, the greeter program will request a username and password for authentication. However some systems may be configured to use supplemental mechanisms such as a fingerprint or SmartCard readers. GDM can be configured to support these alternatives in parallel with greeter login extensions and the --enable-split-authentication ./configure option, or one at a time via system PAM configuration. The smartcard extension can be enabled or disabled via the org.gnome.display-manager.extensions.smartcard.active gsettings key. Likewise, the fingerprint extension can be enabled or disabled via the org.gnome.display-manager.extensions.fingerprint.active gsettings key. GDM 和 PAM 可配置为不需要任何输入，这将使 GDM 自动登陆并直接启动一个会话，这在一些环境中会很有用，如单用户系统或售报亭。 In addition to authentication, the greeter program allows the user to select which session to start and which language to use. Sessions are defined by files that end in the .desktop suffix and more information about these files can be found in the "GDM User Session and Language Configuration" section of this document. By default, GDM is configured to display a face browser so the user can select their user account by clicking on an image instead of having to type their username. GDM keeps track of the user's default session and language in the user's ~/.dmrc and will use these defaults if the user did not pick a session or language in the login GUI. After authenticating a user, the daemon runs the PostLogin script as root, then runs the PreSession script as root. After running these scripts, the user session is started. When the user exits their session, the PostSession script is run as root. These scripts are provided as hooks for distributions and end-users to customize how sessions are managed. For example, using these hooks you could set up a machine which creates the user's $HOME directory on the fly, and erases it on logout. The difference between the PostLogin and PreSession scripts is that PostLogin is run before the pam_open_session call so is the right place to do anything which should be run before the user session is initialized. The PreSession script is called after session initialization. GDM 欢迎程序在屏幕底部显示一个浮动面板，提供了一些额外的功能。当选择一个用户后，还可以在面板选择登录后使用的会话、语言、键盘布局等。键盘布局选择器在您输入密码时也会改变键盘布局。面板还包括一个登录服务区域以放置状态图标。比如显示当前电量的电池图标，和用于启用辅助功能的图标。欢迎程序还提供了允许用户关闭或重启系统的按钮。如有需要，也可以配置 GDM 不提供关机和重启按钮。GDM 还可通过 PolicyKit(或 Oracle Solaris 上的 RBAC)来配置，用户拥有适当的授权才允许关机或重启。 注意，键盘布局功能只有在支持 libxklavier 的系统上可以使用。 GDM 支持“无障碍登录”，允许用户登录他们的桌面，即使他们不能以普通的方式方便地使用屏幕、鼠标或键盘。无障碍技术(AT)功能，比如屏幕键盘、屏幕阅读器、屏幕放大器和 Xserver AccessX 键盘辅助都是可用的。如果需要，也可以放大文本或高对比图标和控制。参考本文档的“辅助功能配置”节获取更多关于多少中无障碍功能可以配置。 在一些操作系统上，必须确保 GDM 用户是“audio”组的成员，以使要求声音输出的 AT 程序(例如文本语音转换)可以工作。 头像浏览器是一个允许用户通过点击一个图像以选择他用户名的界面。这项功能可以通过 /apps/gdm/simple-greeter/disable_user_list GConf 键来启用或禁用，其默认是启用的。禁用时，用户必须手动输入他们的用户名全名。启用时，它显示本地系统上所有的用来登录的用户名(在 /etc/passwd 文件中定义的有合法的 shell ，并且足够高的 UID 的所有用户)，以及最近登录过的远程用户。GDM 2.20 版和更早版中的头像登录器可能试图显示所有的远程用户，这在大的企业部署中造成了性能问题。 头像登录器配置为在列表顶端显示最经常登录的用户。这可以确保经常登录的用户可以快速的找到他们的登录图片。 头像登录器支持前缀字母过滤(type-ahead search)，其依据用户的输入来匹配列表中的用户名，动态移动选中的头像。这意味着，一个有很长用户名的用户在从列表中选择之前将只需要输入用户名开始的几个字符。 The icons used by GDM can be installed globally by the sysadmin or can be located in the user's home directories. If installed globally they should be in the <share>/pixmaps/faces/ directory and the filename should be the name of the user. Face image files should be a standard image that GTK+ can read, such as PNG or JPEG. Face icons placed in the global face directory must be readable to the GDM user. If there is no global icon for the user, GDM will look in the user's $HOME directory for the image file. GDM will first look for the user's face image in ~/.face. If not found, it will try ~/.face.icon. If still not found, it will use the value defined for "face/picture=" in the ~/.gnome2/gdm file. 如果一个用户没有定义的头像图片，GDM 将使用当前 GTK+ 主题的“stock_person”图标。如果没有定义这个图片，将回退使用一个通用的头像图片。 请注意，加载和缩放位于远程用户主目录的头像可能会是非常消耗时间的任务。因为通过 NIS 或 NFS 加载图片是不实际的，GDM 不尝试从远程主目录加载头像图片。 当这个浏览器打开时，这个计算机上的合法用户将暴露给任何人。如果启用了 XDMCP，用户名将暴露给远程用户。 这当然会对安全性有所限制，因为恶意用户不再需要猜测合法用户名。在一些非常严格的环境下，头像登录可能是不适当的。 GDM 守护进程可以被配置为监听和管理从远程显示器上的 X 显示管理协议(XDMCP)请求。XDMCP 是默认关闭的，但是如果需要可以开启。如果 GDM 构建为支持 TCP Wrapper，则守护进程将只准许在 TCP Wrappers 配置文件指定了 GDM 服务节的主机的访问。 GDM 包括了一些使它可以在对 XDMCP 服务的拒绝服务攻击更有抵抗力的方法。许多协议参数，握手计时等，可以进行微调。默认设置可以在多数系统上合理的工作。 GDM 默认使用普通 UDP 的用于 XDMCP 的 177 端口监听 XDMCP 请求，将通过向发端发送一个 WILLING 包响应 QUERY 或 BROADCAST_QUERY 请求。 GDM 可以配置为实现 INDIRECT 查询和呈现一个主机选择器用以远程显示。GDM 会记住用户的选择并继续发送请求到选择管理器。GDM 也支持一个可以在用户连接成功后，让它忘记重定向协议的扩展。这个扩展仅在全部进程是 GDM 时才支持。它是透明的并且被 XDM 或其他实现 XDMCP 的守护进程所忽略。 If XDMCP seems to not be working, make sure that all machines are specified in /etc/hosts. 参考“安全”部分来获取关于使用 XDMCP 时的安全相关的信息。 GDM uses syslog to log errors and status. It can also log debugging information, which can be useful for tracking down problems if GDM is not working properly. Debug output can be enabled by setting the debug/Enable key to "true" in the <etc>/gdm/custom.conf file. Output from the various Xservers is stored in the GDM log directory, which is normally <var>/log/gdm/. Any Xserver messages are saved to a file associated with the display value, <display>.log. The session output is piped through the GDM daemon to the ~/$XDG_CACHE_HOME/gdm/session.log file which usually expands to ~/.cache/gdm/session.log. The file is overwritten on each login, so logging out and logging back into the same user via GDM will cause any messages from the previous session to be lost. Note that if GDM can not create this file for some reason, then a fallback file will be created named ~/$XDG_CACHE_HOME/gdm/session.log.XXXXXXXX where the XXXXXXXX are some random characters. GDM 允许多个用户同时登录。一个用户登录以后，另一个用户可以使用 GNOME 面板上的 用户切换器登录，或者从 GNOME 屏幕保护的锁住屏幕上的“切换用户”按钮。进行中的会话可以使用同样的机制更改回来并且继续。注意，有些发行版可能没有默认在面板上添加用户切换器。您可以使用面板右键快捷菜单添加它。 注意，这个功能可以在支持虚拟终端的系统上使用。如果虚拟终端不可用，这个功能将不可用。 为了安全，建议用一个专用的用户和组 ID 来进行适当的操作。在大多数系统上，这个用户和组一般是“gdm”，但是可以被配置为任何一个用户或组。所有的 GDM 图形程序都以这个用户的身份运行，以使与用户交互的程序都运行在沙盒中。这个用户和组应该具有有限制的特权。 The only special privilege the "gdm" user requires is the ability to read and write Xauth files to the <var>/run/gdm directory. The <var>/run/gdm directory should have root:gdm ownership and 1777 permissions. You should not, under any circumstances, configure the GDM user/group to a user which a user could easily gain access to, such as the user nobody. Any user who gains access to an Xauth key can snoop on and control running GUI programs running in the associated session or perform a denial-of-service attack on it. It is important to ensure that the system is configured properly so that only the "gdm" user has access to these files and that it is not easy to login to this account. For example, the account should be setup to not have a password or allow non-root users to login to the account. GDM 欢迎界面配置存储于 GConf 中。要允许 GDM 用户更改配置，就需要“gdm”用户有一个可写的 $HOME 目录。用户可以配置默认的 GConf 到希望的样子，以避免需要提供给“gdm”用户一个可写的 $HOME 目录。但是，如果不能写入状态信息到 GConf 配置，一些功能可能被禁用。 GDM 使用 PAM 作为登录认证。PAM 代表可插入的认证模块，被您计算机上大多数需要认证的程序使用。它允许管理员为不同的登录程序 (例如 ssh，登录界面，屏幕保护等) 配置特定的认证行为。 PAM 是复杂和高度可配置的，本文档不打算在细节上解释这些。而是，它打算给出 PAM 配置与 GDM 的关系，GDM 是怎样配置 PAM 的，以及已知的问题的一个概述。需要操作 PAM 配置的用户需要进一步阅读 PAM 文档，以理解怎样配置 PAM 和理解在这节中使用的条目。 PAM configuration has different, but similar, interfaces on different Operating Systems, so check the pam.d or pam.conf man page for details. Be sure you read the PAM documentation and are comfortable with the security implications of any changes you intend to make to your configuration. 注意，默认地，GDM 使用“gdm”这个 PAM 服务名作默认登录用，以及使用“gdm-autologin”PAM服务名作自动登录用。这些服务可能没有在您的 pam.d 或 pam.conf 配置文件中定义。如果没有这些条目，GDM 将使用默认的 PAM 行为。在大多数系统上，这应该可以工作的很好。但是，如果 gdm-autologin 服务没有定义，自动登录功能将可能不能失效。 The PostLogin script is run before pam_open_session is called, and the PreSession script is called after. This allows the system administrator to add any scripting to the login process either before or after PAM initializes the session. If you wish to make GDM work with other types of authentication mechanisms (such as a fingerprint or SmartCard reader), then you should implement this by using a PAM service module for the desired authentication type rather than by trying to modify the GDM code directly. Refer to the PAM documentation on your system. 为了能够同时使用多种认证方式，例如既可使用智能卡也可使用用户名和口令登录系统，PAM 做了一些限制。使这可以工作有一些技巧，当设置这种配置时，最好研究下这个问题一般是怎么解决的。 如果自动登录在一个系统上不工作，检查在 PAM 配置文件中是否定义了“gdm-autologin”PAM 栈。为了使它工作，必须使用一个不做任何认证的 PAM 模块，或者简单的对它所有的公共界面返回 PAM_SUCCESS。假定您的系统上有个 pam_allow.so PAM 模块可以做到这一点，启用“gdm-autologin”的 PAM 配置可能会类似这样： gdm-autologin auth required pam_unix_cred.so.1 gdm-autologin auth sufficient pam_allow.so.1 gdm-autologin account sufficient pam_allow.so.1 gdm-autologin session sufficient pam_allow.so.1 gdm-autologin password sufficient pam_allow.so.1 上边的设置将导致没有最后的日志项生成。如果想要一个最后日志项，请对这个会话使用下面的方法： gdm-autologin session required pam_unix_session.so.1 如果计算机由多个人使用，这时自动登录就不合适了，您将可能希望允许一些用户不输入他们的口令就可以登录。这个功能可以作为单个用户选项，使用 gnome-system-tools 中的 users-admin 工具来启用；这由在要求口令之前检查用户是否 Unix 组“nopasswdlogin”的成员来实现。要使这可以工作，“gdm”服务的 PAM 配置文件必须包含类似于如下一行： gdm auth sufficient pam_succeed_if.so user ingroup nopasswdlogin GDM generates utmp and wtmp User Accounting Database entries upon session login and logout. The utmp database contains user access and accounting information that is accessed by commands such as finger, last, login, and who. The wtmp database contains the history of user access and accounting information for the utmp database. Refer to the utmp and wtmp man pages on your system for more information. Xserver authorization files are stored in a newly created subdirectory of <var>/run/gdm at start up. These files are used to store and share a "password" between X clients and the Xserver. This "password" is unique for each session logged in, so users from one session can't snoop on users from another. GDM 只支持 MIT-MAGIC-COOKIE-1 Xserver 认证方案。通常从其他方案获得的好处非常少，并且至今也没有为实现它们做出的努力。尤其要小心地使用 XDMCP，因为 Xserver 认证 cookie 以明文通过线路。如果可以嗅探，攻击者就可以容易的在您登录时嗅探您的认证口令，无论使用何种认证方案。如果可以嗅探且是不可取的，此时您应该使用 ssh 作为 X 连接的隧道而不是使用 XDMCP。您可以将 XDMCP 看成一种图形化的 telnet，其有同样的安全问题。多数情况下，ssh -Y 应该会优于 GDM 的 XDMCP 功能。 即使您的显示受到 cookies 的保护，输入口令时的 XEvent 和因而的按键仍然是通过明文发送的。捕获它是很容易的。 XDMCP 主要用于运行瘦客户机，比如在终端实验室。那些瘦客户机只需要到访问服务器的网络连接，这使这些瘦客户机在一个外部不能访问的分离网络中并且只能连接到服务器好像是最好的安全策略。仅有的需要从外部访问的点就是服务器。这种设置绝不应该使用一个未管理的集线器或其他可嗅探的网络。 XDMCP 访问控制是使用的 TCP wrappers。也可以不带 TCP wrappers 地编译 GDM，所以这个功能可能不被一些操作系统支持。 You should use the daemon name gdm in the <etc>/hosts.allow and <etc>/hosts.deny files. For example to deny computers from .evil.domain from logging in, then add gdm: .evil.domain to <etc>/hosts.deny. You may also need to add gdm: .your.domain to your <etc>/hosts.allow if you normally disallow all services from all hosts. See the hosts.allow(5) man page for details. 即使是 GDM 尝试尽量智能地防止使攻击者 对 XDMCP 有机可乘，仍然建议您在您的防火墙上阻塞 XMDCP 端口(一般是 UDP 端口 177)，除非真的需要。GDM 防止拒绝服务攻击，但是 X 协议仍然继承了不安全，并且只应该在可控的环境中使用。同样，每个远程连接消耗许多资源，所以通过 XDMCP 进行拒绝服务攻击比攻击一个网页服务器容易的多。 阻塞所有的 Xserver 端口也是明智的，它们您防火墙上的 TCP 端口 6000+ (对应每个显示号)。注意 GDM 也会使用显示号 20 和根据服务需要较大的号。 X 在通过国际互联网使用时不是一个非常安全的协议，XDMCP 甚至更不安全。 GDM 可以配置为使用 PolicyKit，以允许系统管理员控制登录窗口是否应该在欢迎窗口提供关机和重启按钮。 These buttons are controlled by the org.freedesktop.consolekit.system.stop-multiple-users and org.freedesktop.consolekit.system.restart-multiple-users actions respectively. Policy for these actions can be set up using the polkit-gnome-authorization tool, or the polkit-auth command line program. GDM 可以被设置为使用 RBAC 替代 PolicyKit。这是，RBAC 的配置将被用于控制登录窗口是否在欢迎屏幕提供关机和重启键。 For example, on Oracle Solaris, the "solaris.system.shutdown" authorization is used to control this. Simply modify the /etc/user_attr file so that the "gdm" user has this authorization. GDM 包含了对使用用户和会话登录框架，即所谓的 ConsoleKit，发布用户登录信息的支持。ConsoleKit 可以跟踪所有的当前登录用户。在这个角度上看，它可以替代大多数类 Unix 操作系统上都有的 utmp 和 utmpx文件。 当 GDM 将为用户创建一个新的登录进程，为了为此用户打开一个新会话它将调用 ConsoleKit 的一个特权方法。同时 GDM 也提供 ConsoleKit，并附随关于用户会话的信息，例如：用户 ID，将于会话关联的 X11 显示名，会话起源的主机名(在 XDMCP 会话时有用)，此会话是否连接等。就像启用用户会话的其它程序一样，GDM 处于特别的知晓用户会话和被信任并提供他们的信息的位置。这些特权方法的使用是受到使用 D-BUS 系统信息总线安全策略的限制的。 当一个通过 GDM 认证的现存会话上的用户请求回复一个存在的会话，GDM 调用 ConsoleKit 的一个特权方法来解锁那个会话。关于那个会话收到解锁信号后发生的精确的细节是未定的和与会话有关的。但是，大多数会话会解锁一个屏保作为回应。 当用户选择登出，或者 GDM 或会话异常退出，用户会话将从 ConsoleKit 注销。 GDM 有一些配置界面，包括脚本集成点、守护进程配置、欢迎界面配置、通用会话配置、与 gnome-settings-daemon 配置的集成以及会话配置。这些集成的细节在下边描述。 The GDM script integration points can be found in the <etc>/gdm/ directory: Xsession Init/ PostLogin/ PreSession/ PostSession/ The Init, PostLogin, PreSession, and PostSession scripts all work as described below. For each type of script, the default one which will be executed is called "Default" and is stored in a directory associated with the script type. So the default Init script is <etc>/gdm/Init/Default. A per-display script can be provided, and if it exists it will be run instead of the default script. Such scripts are stored in the same directory as the default script and have the same name as the Xserver DISPLAY value for that display. For example, if the <Init>/:0 script exists, it will be run for DISPLAY ":0". 所有的这些脚本都使用 root 特权运行，运行成功时返回 0，如果有任何会导致登录会话结束的失败都会返回非零值。同样注意，GDM 将一直阻塞到脚本运行完毕，所以，如果这些脚本的任何一个挂起，都会导致登录进程挂起。 When the Xserver for the login GUI has been successfully started, but before the login GUI is actually displayed, GDM will run the Init script. This script is useful for starting programs that should be run while the login screen is showing, or for doing any special initialization if required. After the user has been successfully authenticated GDM will run the PostLogin script. This is done before any session setup has been done, including before the pam_open_session call. This script is useful for doing any session initialization that needs to happen before the session starts. For example, you might setup the user's $HOME directory if needed. After the user session has been initialized, GDM will run the PreSession script. This script is useful for doing any session initialization that needs to happen after the session has been initialized. It can be used for session management or accounting, for example. When a user terminates their session, GDM will run the PostSession script. Note that the Xserver will have been stopped by the time this script is run, so it should not be accessed. Note that the PostSession script will be run even when the display fails to respond due to an I/O error or similar. Thus, there is no guarantee that X applications will work during script execution. All of the above scripts will set the $RUNNING_UNDER_GDM environment variable to yes. If the scripts are also shared with other display managers, this allows you to identify when GDM is calling these scripts, so you can run specific code when GDM is used. The <share>/gdm/autostart/LoginWindow directory contains files in the format specified by the "FreeDesktop.org Desktop Application Autostart Specification". Standard features in the specification may be used to specify programs that should auto-restart or only be launched if a GConf configuration value is set, etc. Any .desktop files in this directory will cause the associated program to automatically start with the login GUI greeter. By default, GDM is shipped with files which will autostart the gdm-simple-greeter login GUI greeter itself, the gnome-power-manager application, the gnome-settings-daemon, and the metacity window manager. These programs are needed for the greeter program to work. In addition, desktop files are provided for starting various AT programs if the configuration values specified in the Accessibility Configuration section below are set. There is also an Xsession script located at <etc>/gdm/Xsession which is called between the PreSession and the PostSession scripts. This script does not support per-display like the other scripts. This script is used for actually starting the user session. This script is run as the user, and it will run whatever session was specified by the Desktop session file the user selected to start. The GDM daemon is configured using the <etc>/gdm/custom.conf file. Default values are stored in GConf in the gdm.schemas file. It is recommended that end-users modify the <etc>/gdm/custom.conf file because the schemas file may be overwritten when the user updates their system to have a newer version of GDM. 注意，旧版的 GDM 支持其他的配置选项，但是最新版的 GDM 已经不支持它们了。 The <etc>/gdm/custom.conf file is in the keyfile format. Keywords in brackets define group sections, strings before an equal sign (=) are keys and the data after equal sign represents their value. Empty lines or lines starting with the hash mark (#) are ignored. The file <etc>/gdm/custom.conf supports the "[daemon]", "[security]", and "[xdmcp]" group sections. Within each group, there are particular key/value pairs that can be specified to modify how GDM behaves. For example, to enable timed login and specify the timed login user to be a user named "you", you would modify the file so it contains the following lines: [daemon] TimedLoginEnable=true TimedLogin=you 下边是支持的配置键全表： Multicast Multicast=false 如果为 true 且启用了 IPv6，chooser 将向本地网络发送一个多播请求然后收集已经加入多播组的机器的回应。 MulticastAddr MulticastAddr=ff02::1 这是本地连接的多播地址。 TimedLoginEnable TimedLoginEnable=false If the user given in TimedLogin should be logged in after a number of seconds (set with TimedLoginDelay) of inactivity on the login screen. This is useful for public access terminals or perhaps even home use. If the user uses the keyboard or browses the menus, the timeout will be reset to TimedLoginDelay or 30 seconds, whichever is higher. If the user does not enter a username but just hits the ENTER key while the login program is requesting the username, then GDM will assume the user wants to login immediately as the timed user. Note that no password will be asked for this user so you should be careful, although if using PAM it can be configured to require password entry before allowing login. Refer to the "Security->PAM" section of the manual for more information, or for help if this feature does not seem to work. TimedLogin TimedLogin= 这是会在闲置指定的秒数之后自动登录的用户。 如果值以一个竖线 | (管道符号)结尾，GDM 将激活指定的程序，并且不管程序返回什么值到标准输出上，都作为用户值。程序以 DISPLAY 环境变量的设置来运行，因而使为每个用户指定不同显示样式成为可能。例如，如果值是 “/usr/bin/getloginuser|”，那么将会运行程序 “/usr/bin/getloginuser” 来获取用户值。 TimedLoginDelay TimedLoginDelay=30 Delay in seconds before the TimedLogin user will be logged in. AutomaticLoginEnable AutomaticLoginEnable=false If true, the user given in AutomaticLogin should be logged in immediately. This feature is like timed login with a delay of 0 seconds. AutomaticLogin AutomaticLogin= This is the user that should be logged in immediately if AutomaticLoginEnable is true. 如果值以一个竖线 | (管道符号)结尾，GDM 将激活指定的程序，并且不管程序返回什么值到标准输出上，都作为用户值。程序以 DISPLAY 环境变量的设置来运行，因而使为每个用户指定不同显示样式成为可能。例如，如果值是 “/usr/bin/getloginuser|”，那么将会运行程序 “/usr/bin/getloginuser” 来获取用户值。 User User=gdm The username under which the greeter and other GUI programs are run. Refer to the User configuration key and to the "Security->GDM User And Group" section of this document for more information. Group Group=gdm The group name under which the greeter and other GUI programs are run. Refer to the Group configuration key and to the "Security->GDM User And Group" section of this document for more information. Enable Enable=false To enable debugging, set the debug/Enable key to "true" in the <etc>/gdm/custom.conf file and restart GDM. Then debug output will be sent to the system log file (<var>/log/messages or <var>/adm/messages depending on your Operating System). DisallowTCP DisallowTCP=true If true, then always append -nolisten tcp to the command line when starting attached Xservers, thus disallowing TCP connection. This is a more secure configuration if you are not using remote connections. DisplaysPerHost DisplaysPerHost=1 为了防止攻击者填满等待队列，GDM 只允许一台远程计算机发起一个连接。如果希望为有多个显示器的计算机提供服务，您需要增加这个值。 注意连接到本地的显示器数目允许值没有被限制。只有通过 XDMCP 的远程连接被这个配置选项限制。 Enable Enable=false 设置这项为 true，启用 XDMCP 支持，允许让 GDM 管理远程显示/X 终端。 gdm listens for requests on UDP port 177. See the Port option for more information. If GDM is compiled to support it, access from remote displays can be controlled using the TCP Wrappers library. The service name is gdm You should add gdm:.my.domain to your <etc>/hosts.allow, depending on your TCP Wrappers configuration. See the hosts.allow man page for details. 请注意，XDMCP 不是一个相当安全的协议，使用防火墙堵住 UDP 的 177 端口是个好注意，除非您真的需要它。 HonorIndirect HonorIndirect=true Enables XDMCP INDIRECT choosing (i.e. remote execution of gdmchooser) for X-terminals which do not supply their own display browser. MaxPending MaxPending=4 为了避免拒绝服务攻击，GDM 固定了等待连接的队列的大小。只有 MaxPending 个显示可以同时开启。 请注意，这个参数不限制可以管理的远程显示的数目，只限制同时启动的显示连接的数目。 MaxSessions MaxSessions=16 定义可同时管理的远程显示连接的最大数目，也就是，您的主机上可以使用的远程显示的总数目。 MaxWait MaxWait=30 当 GDM 准备好管理一个显示，一个包含一个唯一的会话 ID 的 ACCEPT 包被发送给它，这个会话 ID 用于将来的 XDMCP 交谈。 GDM 将放置会话 id 在等候队列里，等待以 MANAGE 请求显示的响应。 如果在 MaxWait 秒内仍然没有响应，GDM 将声明显示器死机并且将其从等待队列中清除，为其他显示清理出槽。 MaxWaitIndirect MaxWaitIndirect=30 The MaxWaitIndirect parameter determines the maximum number of seconds between the time where a user chooses a host and the subsequent indirect query where the user is connected to the host. When the timeout is exceeded, the information about the chosen host is forgotten and the indirect slot freed up for other displays. The information may be forgotten earlier if there are more hosts trying to send indirect queries then MaxPendingIndirect. Port Port=177 The UDP port number gdm should listen to for XDMCP requests. Do not change this unless you know what you are doing. Willing Willing=<etc>/gdm/Xwilling 当机器在一个 QUERY 后发送一个 WILLING 包返回，它发送一个字符串给出当前服务的状态。默认的信息是系统 ID，但有可能创建一个脚本显示自定义的消息。如果脚本不存在或者这个键是空的，那么发送默认的消息。如果脚本成功并产生了一些输出，输出的第一行被发送(仅第一行)。它最多每3秒运行一次，以防止服务可能被机器的 QUERY 包塞满而拒绝。 The GDM default greeter is called the simple Greeter and is configured via GConf. Default values are stored in GConf in the gdm-simple-greeter.schemas file. These defaults can be overridden if the "gdm" user has a writable $HOME directory to store GConf settings. These values can be edited using the gconftool-2 or gconf-editor programs. The following configuration options are supported: /apps/gdm/simple-greeter/banner_message_enable false (boolean) 控制浮动信息文本是否显示。 /apps/gdm/simple-greeter/banner_message_text NULL (string) 指定在欢迎窗口显示浮动文本消息。 /apps/gdm/simple-greeter/disable_restart_buttons false (boolean) 控制是否在登录窗口显示重启按钮。 /apps/gdm/simple-greeter/disable_user_list false (boolean) 如果为 true，不在登录窗口显示已知用户的头像登录功能。 /apps/gdm/simple-greeter/logo_icon_name computer (string) 设置为要使用的主题图标名，以获取欢迎标志。 /apps/gdm/simple-greeter/recent-languages [] (string list) 设定语言列表，以便在登录窗口显示默认语言。默认值是“[]”，用默认的设定仅显示系统语言，选项“其他...”弹出一个对话框，显示用户可选择的所有可用的语言列表。 不希望用户手动更改这项设置，而是，GDM 跟踪在配置键中选中的任何语言，并且在语言组合框中与“其他...”一起单独显示他们。这种方式，使常用的语言可以容易的选择。 /apps/gdm/simple-greeter/recent-layouts [] (string list) 设置在默认的登录面板上显示的键盘布局的列表。默认值是“[]”。使用默认的配置时，只显示默认的键盘布局，其他的选项在“其他...”中，其弹出一个对话框，显示所有可用的键盘布局，以供用户选择。 不希望用户手动更改这项设置，而是，GDM 跟踪在配置键中选中的任何语言布局，并且在键盘布局组合框中与“其他...”一起单独显示他们。这种方式，使常用的键盘布局可以容易的选择。 /apps/gdm/simple-greeter/wm_use_compiz false (boolean) 控制是否使用 compiz 替换 metacity 作为窗口管理器。 本节描述 GDM 可用的辅助功能配置选项。 登录界面的 GDM 欢迎面板显示一个辅助功能图标。点击这个图标，打开 GDM 辅助功能对话框。在 GDM 辅助功能对话框中，有一列复选框，用户可以启用或禁用相关的辅助选项。 复选框对应屏幕键盘、屏幕放大镜和屏幕阅读器辅助工具作用于三个 GConf 键，这在本文档的下一节中讲述。通过启用或禁用这些复选框，相关联的 GConf 键设置为“true”或“false”。当 GConf 键设为 true，辅助工具关联这些 GConf 键启动，当 GConf 键设为 false，辅助工具关联这些 GConf 键禁用。这些 GConf 键在用户登录后，不会自动重置为默认状态。所以，上次 GDM 登录的会话中的辅助工具，在下次登录会话时会自动运行启动。 GDM 辅助功能对话框中的其他的复选框没有对应的 GConf 键，因为没有启动额外的程序来提供这些辅助功能特性。其他选项对应 Xserver 对应的辅助功能特性，其在 GDM 会话中一直运行。 GDM 提供如下的 GConf 键来控制它的辅助功能： /desktop/gnome/interface/accessibility false (boolean) 控制辅助功能设施是否由 GDM 图形界面启动。这被许多辅助功能程序的工作所需要。 /desktop/gnome/applications/at/screen_magnifier_enabled false (boolean) 如果设置了，链接到 GConf 键的辅助工具将随着 GDM 图形界面程序启动。默认这是一个屏幕放大镜程序。 /desktop/gnome/applications/at/screen_keyboard_enabled false (boolean) 如果设置了，链接到 GConf 键的辅助工具将随着 GDM 图形界面程序启动。默认这是一个屏幕键盘程序。 /desktop/gnome/applications/at/screen_reader_enabled false (boolean) 如果设置了，链接到 GConf 键的辅助工具将随着 GDM 图形界面程序启动。默认这是一个屏幕阅读程序。 对于 screen_magnifier_enabled, screen_keyboard_enabled 和 screen_reader_enabled GConf 键，要启动的辅助工具依赖于位于 GDM 自启动文件夹的桌面项文件，将在本手册的“自启动配置”一节中讲述。在 GDM 自启动文件夹中的任何桌面项文件，都能够通过 AutostartCondition 指定 GConf 键来链接到它们。桌面项文件中的 AutostartCondition 精确行应该是下列之一： AutostartCondition=GNOME /desktop/gnome/applications/at/screen_keyboard_enabled AutostartCondition=GNOME /desktop/gnome/applications/at/screen_magnifier_enabled AutostartCondition=GNOME /desktop/gnome/applications/at/screen_reader_enabled 当一个辅助功能键是 true，那么所有在 GDM 自启动桌面项文件中，关联到这个键的程序都会启动(除非在那个桌面项文件中 Hidden key 也设为 true)。单一的 GConf 键甚至可以启动多个辅助工具，如果有多个 GDM 自启动文件夹里的桌面项文件用这个AutostartCondition。 例如，如果 GOK 与 GNOME 一起分发，并作为默认的屏幕键盘，那么这可能被一个不同的程序所替换，如果想要这么做的话。要用键盘程序“onboard”替换 GOK，并且额外还激活辅助工具“mousetweaks”支持悬停点击，那么就需要下面的配置项。 为 onboard 创建一个桌面项文件，再为 mousetweaks 创建另一个，例如 onboard.desktop 和 mousetweaks.desktop。这些文件必须放在 GDM 自启动文件夹，格式要求在本文档的“自启动配置”一节里解释。 The following is an example onboard.desktop file: [Desktop Entry] Encoding=UTF-8 Name=Onboard Onscreen Keyboard Comment=Use an on-screen keyboard TryExec=onboard Exec=onboard --size 500x180 -x 20 -y 10 Terminal=false Type=Application StartupNotify=true Categories=GNOME;GTK;Accessibility; AutostartCondition=GNOME /desktop/gnome/applications/at/screen_keyboard_enabled The following is an example mousetweaks.desktop file: [Desktop Entry] Encoding=UTF-8 Name=Software Mouse-Clicks Comment=Perform clicks by dwelling with the pointer TryExec=mousetweaks Exec=mousetweaks --enable-dwell -m window -c -x 20 -y 240 Terminal=false Type=Application StartupNotify=true Categories=GNOME;GTK;Accessibility; AutostartCondition=GNOME /desktop/gnome/applications/at/screen_keyboard_enabled 注意 AutostartCondition 一行，是为屏幕键盘将全部桌面项文件链接到 GConf 键。 要在启动时禁用 GOK，用于 GOK 屏幕键盘的桌面项文件必须删除或禁用。否则 onboard 和 GOK 将同时启动。这可以通过删除 GDM 自启动文件夹中的 gok.desktop 文件，或者在 gok.desktop 文件中添加“Hidden=true”。 经过这些改变，当用户在 GDM 会话中激活屏幕键盘时，GOK 将不再会运行，而 onboard 和 mousetweaks 会取代它启动。 GDM 欢迎程序使用一些与您桌面会话中相同的框架程序，因而，一些 GConf 设置会相互影响，对于这些设置，欢迎程序会使用默认值，除非它被：1) GDM 的安装强制策略覆盖，2) 系统强制策略覆盖。GDM 安装时用它自己的强制策略为了安全锁定了一些设置。 GDM 启用了 gnome-settings-daemon 的下列插件：a11y-keyboard, background, sound, xsettings。 他们负责例如背景图片，字体和主题设置，声音事件等。 Plugins can also be disabled using GConf. For example, if you want to disable the sound plugin then unset the following key: /apps/gdm/simple-greeter/settings-manager-plugins/sound/active. GDM sessions are specified using the FreeDesktop.org Desktop Entry Specification, which can be referenced at the following URL: http://www.freedesktop.org/wiki/Specifications/desktop-entry-spec. By default, GDM will install desktop files in the <share>/xsessions directory. GDM will search the following directories in this order to find desktop files: <etc>/X11/sessions/, <dmconfdir>/Sessions, <share>/xsessions, and <share>/gdm/BuiltInSessions. By default the <dmconfdir> is set to <etc>/dm/ unless GDM is configured to use a different directory via the "--with-dmconfdir" option. A session can be disabled by editing the desktop file and adding a line as follows: Hidden=true. GDM desktop files support a GDM-specific extension, a key named "X-GDM-BypassXsession". If the key is not specified in a desktop file, the value defaults to "false". If this key is specified to be "true" in a desktop file, then GDM will launch the program specified by the desktop file "Exec" key directly when starting the user session. It will not run the program via the <etc>/gdm/Xsession script, which is the normal behavior. Since bypassing the <etc>/gdm/Xsession script avoids setting up the user session with the normal system and user settings, sessions started this way can be useful for debugging problems in the system or user scripts that might be preventing a user from being able to start a session. The user's default session and language choices are stored in the ~/.dmrc file. When a user logs in for the first time, this file is created with the user's initial choices. The user can change these default values by simply changing to a different value when logging in. GDM will remember this change for subsequent logins. The ~/.dmrc file is in the standard INI format. It has one section called [Desktop] which has two keys: Session and Language. The Session key specifies the basename of the session .desktop file that the user wishes to normally use without the .desktop extension. The Language key specifies the language that the user wishes to use by default. If either of these keys is missing, the system default is used. The file would normally look as follows: [Desktop] Session=gnome Language=cs_CZ.UTF-8 The GDM package provides the following commands in sbindir intended to be run by the root user: gdm is the main daemon which sets up graphical login environment and starts necessary helpers. -?, --help 给出命令行选项的一个简单概述。 --fatal-warnings 使所有的警告都可以造成 GDM 退出。 --timed-exit 30秒之后退出，对调试有用。 --version 显示 GDM 守护进程的版本。 gdm-restart stops and restarts GDM by sending the GDM daemon a HUP signal. This command will immediately terminate all sessions and log out users currently logged in with GDM. gdm-safe-restart stops and restarts GDM by sending the GDM daemon a USR1 signal. GDM will be restarted as soon as all users log out. gdm-stop stops GDM by sending the GDM daemon a TERM signal. 这一节讨论对了解 GDM 工作有用的小提示。通常，如果您使用 GDM 出现问题，您可以提交一个错误报告，或者发送邮件到 gdm-list 邮件列表，相关信息可以参阅一下本文档介绍一节内容。 If GDM is failing to work properly, it is always a good idea to include debug information. To enable debugging, set the debug/Enable key to "true" in the <etc>/gdm/custom.conf file and restart GDM. Then use GDM to the point where it fails, and debug output will be sent to the system log file (<var>/log/messages or <var>/adm/messages depending on your Operating System). If you share this output with the GDM community via a bug report or email, please only include the GDM related debug information and not the entire file since it can be large. If you do not see any GDM syslog output, you may need to configure syslog (refer to the syslog man page). 有许多问题可能会导致 GDM 启动失败，这一节讨论一些普通问题，以及如何在 GDM 启动中跟踪一个错误。一些问题将会使 GDM 返回一个错误消息或对话框，当它试图启动的时候，但若是 GDM 没有提示就失败了，那么跟踪错误就比较困难。 首先确保 Xserver 配置正确，GDM 配置文件在 [server-Standard] 小节里包含一个启动 Xserver 的命令。验证这个命令可以在您系统上工作，从控制台里运行这个命令应该可以启动 Xserver，如果启动失败，那么问题可能出在您的 Xserver 配置文件。访问 Xserver 的错误日志，寻找这个错误出现的可能原因。错误也可能是您的 Xserver 需要其他的命令行选项。如果是这样，那么就在 GDM 配置文件中设置 Xserver 命令，以便它正确运行在您的系统上。 Also make sure that the /tmp directory has reasonable ownership and permissions, and that the machine's file system is not full. These problems will cause GDM to fail to start. This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. A copy of the GNU General Public License is included as an appendix to the GNOME Users Guide. You may also obtain a copy of the GNU General Public License from the Free Software Foundation by visiting their Web site or by writing to

Free Software Foundation, Inc. 51 Franklin Street, Fifth Floor Boston, MA 02110-1301 USA