7:16 a.m.
I'm searching for a method to display a consent to monitoring statement
on either GDM or KDM in Fedora 9. I'm not tied into either display
manager so whichever one is easiest to set up wins. The message
displayed is about 25 lines in a standard text file layout, and all
users must acknowledge the statement by clicking an OK button before
they are allowed a login attempt. This was pretty easy to do under Core
6 by having /etc/motd contain the required text and referencing it in
/etc/gdm/custom.conf like so:
[greeter]
InfoMsgFile=/etc/motd
InfoMsgFont=Courier Bold 17
GraphicalTheme=Bluecurve
Has anyone found a way to set this up in Fedora 9? GDM doesn't seem to
pay any attention to the greeter section in custom.conf any longer.
--
Stephen Berg
Systems Administrator
NRL Code: 7321
Office: 228-688-5738
stephen.berg.ctr(a)nrlssc.navy.mil
1:37 p.m.
Stephen Berg (Contractor) wrote:
I'm searching for a method to display a consent to monitoring
statement
on either GDM or KDM in Fedora 9. I'm not tied into either display
an interesting question, which you may not have found and answer.
i do not know how this would work, and maybe some others can make some
further suggestions.
years back under cromix and early unix, i modified 'passwd' to restrict
logins to certain programs.
applying this to linux, should/may not be all that different.
instead of using '/bin/bash' as startup shell, consider something like
'/bin/bash/consent'.
'consent' could then be a script to display consent agreement and prompt
for a 'y/n' reply. if $1 = 'y' then startx. if $1 = 'n' then
exit.
something to think about.
hth.
--
tc,hago.
g
.
in a free world without fences, who needs gates.
10:20 p.m.
Tim wrote:
Personally, I don't see that clicking on an additional
"yes" button
makes any difference. I'll click on it and lie, anyway. Or not abuse
the system, anyway.
not for sure, but he may be talking about a military base use.
not a good place to lie about such things.
--
tc,hago.
g
.
in a free world without fences, who needs gates.
1:55 a.m.
Nifty Fedora Mitch wrote:
Years ago I was asked to remove the word "Welcome" from any
login
<snip>
(1) "do not feed the dog" might be expanded to
"do not feed my dog your arm, leg, or other body parts"
but it is not....
lol.
all in all, a great read.
to which, i can only say,
'life is a bitch, and then you die'.
--
tc,hago.
g
.
in a free world without fences, who needs gates.
3:17 a.m.
Aldo Foot wrote:
It's a legal requirement in some places to display some text
advising the user that their keystrokes may be monitored and
i agree with these and even tho op may not be needing this agreement for
'military' use, he may want it for his own employees.
--
tc,hago.
g
.
in a free world without fences, who needs gates.
1 p.m.
On Wed, Jul 16, 2008 at 8:20 PM, g <geleem(a)bellsouth.net> wrote:
Tim wrote:
>
> Personally, I don't see that clicking on an additional "yes" button
> makes any difference. I'll click on it and lie, anyway. Or not abuse
> the system, anyway.
not for sure, but he may be talking about a military base use.
not a good place to lie about such things.
--
tc,hago.
g
It's a legal requirement in some places to display some text
advising the user that their keystrokes may be monitored and
other things. They can use the system if they are good with that.
I heard of a least once case that was decided because of what
the login banner said and whether the person actually consented
to it. So I can see the OP's concern.
~af
12:04 a.m.
Tim wrote:
I'm inclined to make a pithy comment about the military and
truth, but I
don't think I'll bother. ;-)
there is a lot of controversy about such, some of which i might tend to
agree. not bothering, i do agree with. this list is just not place for
it, even as an 'ot'.
Going back to what I said earlier, though. There's little
difference
i can tell you have never been in military, as there is a long and true
saying. 'there is a right way, a wrong way, and a military way'.
their obligations either way, clicking on one more thing isn't
going to
force them to do what they should.
no. it does not. but it does give warning and from this warning, if they
violate, then they are subject to full military prosecution.
I can't help but wonder if Fedora would be appropriate for
military use,
i am at wonder about use of fedora also. my understanding is that only
redhat has meet government and military requirements.
--
tc,hago.
g
.
in a free world without fences, who needs gates.
10:57 p.m.
Tim:
> Personally, I don't see that clicking on an additional
"yes" button
> makes any difference. I'll click on it and lie, anyway. Or not abuse
> the system, anyway.
g:
not for sure, but he may be talking about a military base use.
not a good place to lie about such things.
I'm inclined to make a pithy comment about the military and truth, but I
don't think I'll bother. ;-)
Going back to what I said earlier, though. There's little difference
between "by logging on you consent to..." and an extra "by clicking on
'yes' you consent to..." (after you've already logged on, or before you
do so). Either the user is going to obey or abuse, they're informed of
their obligations either way, clicking on one more thing isn't going to
force them to do what they should.
I can't help but wonder if Fedora would be appropriate for military use,
though. I doubt it'd have enough checks made on the code being used for
it to be cleared. Whether that be for security, or simply for
reliability.
--
[tim@localhost ~]$ uname -r
2.6.25.9-76.fc9.i686
Don't send private replies to my address, the mailbox is ignored. I
read messages from the public lists.
8:36 p.m.
On Wed, 2008-07-16 at 15:25 -0500, Stephen Berg (Contractor) wrote:
I've got it working for text logins like ssh but the problem is
logging in via GDM and/or KDM in a gui environment. Users are
required to acknowledge the consent statement before logging in to the
system.
If you're liberal in how you acknowledge acknowledgement being
acknowledged, you could write the agreement into the graphic used as the
background for GDM/KDM/etc, and just take the entry of the username and
password as being the user agreeing.
Personally, I don't see that clicking on an additional "yes" button
makes any difference. I'll click on it and lie, anyway. Or not abuse
the system, anyway.
--
[tim@localhost ~]$ uname -r
2.6.25.9-76.fc9.i686
Don't send private replies to my address, the mailbox is ignored. I
read messages from the public lists.
4 p.m.
Stephen Berg (Contractor) wrote, On 07/16/2008 04:25 PM:
Mikkel L. Ellertson wrote:
> g wrote:
>> Stephen Berg (Contractor) wrote:
>>> I'm searching for a method to display a consent to monitoring
>>> statement on either GDM or KDM in Fedora 9. I'm not tied into
>>> either display
>>
<SNIP>
I've got it working for text logins like ssh but the problem is
logging
in via GDM and/or KDM in a gui environment. Users are required to
acknowledge the consent statement before logging in to the system.
Since gdm-simple-greeter is missing these days, what used to be simple
is now becoming a problem.
Are you interpreting the requirement as a
"The user must actively press a button" 'acknowledge the consent
statement'
or
"by continuing to log into this system you agree/understand the following"
'acknowledge the consent statement'
if you are good with the second meaning then the Welcome setting in
/etc/gdm/custom.conf is what you are looking for.
https://www.redhat.com/archives/fedora-list/2007-December/msg01819.html
modulus:
https://www.redhat.com/archives/fedora-test-list/2008-May/msg00087.html
https://www.redhat.com/archives/fedora-test-list/2008-May/msg00117.html
https://www.redhat.com/archives/fedora-test-list/2008-May/msg00104.html
https://www.redhat.com/archives/fedora-test-list/2008-May/msg00276.html
https://www.redhat.com/archives/fedora-test-list/2008-May/msg00289.html
https://www.redhat.com/archives/fedora-test-list/2008-May/msg00297.html
on F8 in /etc/gdm/custom.conf I had to set
[greeter]
Use24Clock=yes
DefaultWelcome=false
Welcome=our\\n\\n- multi line message
BackgroundType=1
GraphicalTheme=circles
Browser=false
to get something reasonable. I have not bothered with F9 yet as the whole
thing looks like a mess yet.
Please let us know if this gets you where you need to be.
--
Todd Denniston
Crane Division, Naval Surface Warfare Center (NSWC Crane)
Harnessing the Power of Technology for the Warfighter
3:27 p.m.
On Wed, 16 Jul 2008 15:25:48 -0500
"Stephen Berg (Contractor)" <stephen.berg.ctr(a)nrlssc.navy.mil> wrote:
I've got it working for text logins like ssh but the problem is
logging
in via GDM and/or KDM in a gui environment. Users are required to
acknowledge the consent statement before logging in to the system.
What about using a custom gdm theme?
--
MELVILLE THEATRE ~ Melville Sask ~ http://www.melvilletheatre.com
3:25 p.m.
Mikkel L. Ellertson wrote:
g wrote:
> Stephen Berg (Contractor) wrote:
>> I'm searching for a method to display a consent to monitoring
>> statement on either GDM or KDM in Fedora 9. I'm not tied into
>> either display
>
> an interesting question, which you may not have found and answer.
>
> i do not know how this would work, and maybe some others can make some
> further suggestions.
>
> years back under cromix and early unix, i modified 'passwd' to restrict
> logins to certain programs.
>
> applying this to linux, should/may not be all that different.
>
> instead of using '/bin/bash' as startup shell, consider something like
> '/bin/bash/consent'.
>
> 'consent' could then be a script to display consent agreement and prompt
> for a 'y/n' reply. if $1 = 'y' then startx. if $1 = 'n' then
exit.
>
> something to think about.
>
> hth.
>
For text logins, you could use /etc/issue and /etc/issue.net.
Mikkel
I've got it working for text logins like ssh but the problem is logging
in via GDM and/or KDM in a gui environment. Users are required to
acknowledge the consent statement before logging in to the system.
Since gdm-simple-greeter is missing these days, what used to be simple
is now becoming a problem.
--
Stephen Berg
Systems Administrator
NRL Code: 7321
Office: 228-688-5738
stephen.berg.ctr(a)nrlssc.navy.mil
3:15 p.m.
g wrote:
Stephen Berg (Contractor) wrote:
> I'm searching for a method to display a consent to monitoring
> statement on either GDM or KDM in Fedora 9. I'm not tied into either
> display
an interesting question, which you may not have found and answer.
i do not know how this would work, and maybe some others can make some
further suggestions.
years back under cromix and early unix, i modified 'passwd' to restrict
logins to certain programs.
applying this to linux, should/may not be all that different.
instead of using '/bin/bash' as startup shell, consider something like
'/bin/bash/consent'.
'consent' could then be a script to display consent agreement and prompt
for a 'y/n' reply. if $1 = 'y' then startx. if $1 = 'n' then
exit.
something to think about.
hth.
For text logins, you could use /etc/issue and /etc/issue.net.
Mikkel
--
Do not meddle in the affairs of dragons,
for thou art crunchy and taste good with Ketchup!
4:29 p.m.
On Fri, Jul 18, 2008 at 08:17:58AM +0000, g wrote:
Aldo Foot wrote:
> It's a legal requirement in some places to display some text
> advising the user that their keystrokes may be monitored and
i agree with these and even tho op may not be needing this agreement for
'military' use, he may want it for his own employees.
Years ago I was asked to remove the word "Welcome" from any login
prompt on critical systems. The legal advice then was that "Welcome"
was an invitation that removed the rights of the company to prosecute
an intruder. Then there was some noise about "Authorized Users
Only" when there was a lack of information 'who does the authorization'
and how authorized users are notified about their authorization and deauthorization.
This was about the same time that "Beware Dog" signs came down beause
one legal case construed the sign as evidence that the owner knew
he had a bad dog and cause a liability action to be ruled against
a home owner. My sign now says "Do not feed the dog" (1).
In recent times privacy issues have become important for both company data
and employee personal information. In the modern work place employees
have payroll, financial and personal health information emailed to
their company email accounts and filling up browser caches and backups.
It is unclear if this "personal" information is covered by company
privacy rules. Also at the date of hire many employees sign documents --
but after a handful of years those documents go stale in subtle legal
ways and need to be refreshed in an auditable way.
Historically time share systems had a message system where at
login you were presented with status and annoncements.
As best I can tell day to day military security is much less strict
and incures smaller penalty than the current DRM and software package
(did we pay for xyz package) use and audit requirements.
Then there is the naughty stuff witch hunting that
looks for images, naughty words, harassement in the
work place etc.... that might be present on a system.
<rant>
All of this "stuff" may require some notification to "RELEASE THE
COMPANY FROM LIABILITY" and place unchallenged, unaudited responsibility,
norecourse and liability on the employee.
</rant>
Anyhow there are good, bad, and silly reasons for this.
Linux/GNU; Fedora etc. should facilitate this for the good
resons and users should "slash dot" or "Dilbert" the silly and bad
ones.
(1) "do not feed the dog" might be expanded to
"do not feed my dog your arm, leg, or other body parts"
but it is not....
--
T o m M i t c h e l l
Looking for a place to hang my hat.
5753
days inactive
5758
days old
13 comments
8 participants
participants (8)
-
Aldo Foot -
Frank Cox -
g -
Mikkel -
Nifty Fedora Mitch -
Stephen Berg (Contractor) -
Tim -
Todd Denniston