# Manual de referencia del Gestor pantallas de Gnome

GDM es el Gestor de Pantallas de GNOME, un programa gráfico de entrada.

Martin
K.
Petersen

    mkp@mkp.net

George
Lebl

    jirka@5z.com

Brian
Cameron

    Brian.Cameron@Sun.COM

Bill
Haneman

    Bill.Haneman@Sun.COM

1998
1999
Martin K. Petersen
2001
2003
2004
George Lebl
2003
Red Hat, Inc.
2003
2004
Sun Microsystems, Inc.
2003, 2005.
Francisco Javier F. Serrador (serrador@cvs.gnome.org)

Se concede permiso para copiar, distribuir o modificar este documento según las condiciones de la GNU Free Documentation License (GFDL), Versión 1.1 o cualquier versión posterior publicada por la Free Software Foundation sin Secciones invariantes, Textos de portada y Textos de contraportada. Encontrará una copia de la GFDL en este enlace o en el archivo COPYING-DOCS distribuido con este manual.

Este manual forma parte de una colección de documentos de GNOME distribuidos según la GFDL. Si desea distribuir este manual de forma independiente de la colección, puede hacerlo agregando una copia de la licencia al documento, según se describe en la sección 6 de la misma.

Muchos de los nombres utilizados por las empresas para distinguir sus productos y servicios se consideran marcas comerciales. Cuando estos nombres aparezcan en la documentación de GNOME, y siempre que se haya informado a los miembros del Proyecto de documentación de GNOME de dichas marcas comerciales, los nombres aparecerán en mayúsculas o con las iniciales en mayúsculas.

ESTE DOCUMENTO Y LAS VERSIONES MODIFICADAS DEL MISMO SE OFRECEN SEGÚN LAS CONDICIONES ESTABLECIDAS EN LA LICENCIA DE DOCUMENTACIÓN LIBRE DE GNU (GFDL) Y TENIENDO EN CUENTA QUE:

1. EL DOCUMENTO SE ENTREGA "TAL CUAL", SIN GARANTÍA DE NINGÚN TIPO, NI EXPLÍCITA NI IMPLÍCITA INCLUYENDO, SIN LIMITACIÓN, GARANTÍA DE QUE EL DOCUMENTO O VERSIÓN MODIFICADA DE ÉSTE CAREZCA DE DEFECTOS EN EL MOMENTO DE SU VENTA, SEA ADECUADO A UN FIN CONCRETO O INCUMPLA ALGUNA NORMATIVA. TODO EL RIESGO RELATIVO A LA CALIDAD, PRECISIÓN Y UTILIDAD DEL DOCUMENTO O SU VERSIÓN MODIFICADA RECAE EN USTED. SI CUALQUIER DOCUMENTO O VERSIÓN MODIFICADA DE AQUÉL RESULTARA DEFECTUOSO EN CUALQUIER ASPECTO, USTED (Y NO EL REDACTOR INICIAL, AUTOR O AUTOR DE APORTACIONES) ASUMIRÁ LOS COSTES DE TODA REPARACIÓN, MANTENIMIENTO O CORRECCIÓN NECESARIOS. ESTA EXENCIÓN DE RESPONSABILIDAD SOBRE LA GARANTÍA ES UNA PARTE ESENCIAL DE ESTA LICENCIA. NO SE AUTORIZA EL USO DE NINGÚN DOCUMENTO NI VERSIÓN MODIFICADA DE ÉSTE POR EL PRESENTE, SALVO DENTRO DEL CUMPLIMIENTO DE LA EXENCIÓN DE RESPONSABILIDAD;Y

2. EN NINGUNA CIRCUNSTANCIA NI BAJO NINGUNA TEORÍA LEGAL, SEA POR ERROR (INCLUYENDO NEGLIGENCIA) CONTRATO O DOCUMENTO DE OTRO TIPO, EL AUTOR, EL ESCRITOR INICIAL, EL AUTOR DE APORTACIONES NI NINGÚN DISTRIBUIDOR DEL DOCUMENTO O VERSIÓN MODIFICADA DEL DOCUMENTO, NI NINGÚN PROVEEDOR DE NINGUNA DE ESAS PARTES, SERÁ RESPONSABLE ANTE NINGUNA PERSONA POR NINGÚN DAÑO DIRECTO, INDIRECTO, ESPECIAL, INCIDENTAL O DERIVADO DE NINGÚN TIPO, INCLUYENDO, SIN LIMITACIÓN DAÑOS POR PÉRDIDA DE FONDO DE COMERCIO, PARO TÉCNICO, FALLO INFORMÁTICO O AVERÍA O CUALQUIER OTRO POSIBLE DAÑO O AVERÍA DERIVADO O RELACIONADO CON EL USO DEL DOCUMENTO O SUS VERSIONES MODIFICADAS, AUNQUE DICHA PARTE HAYA SIDO INFORMADA DE LA POSIBILIDAD DE QUE SE PRODUJESEN ESOS DAÑOS.

This manual describes version 2.15.1 of the GNOME Display Manager. It was last updated on 05/12/2006.

## Términos y convenciones usados en este manual

This manual describes version 2.15.1 of the GNOME Display Manager. It was last updated on 05/12/2006.

Selector - Un programa que se usa para seleccionar un equipo remoto para gestionar una pantalla remotamente en la pantalla local (`gdmchooser`).

Configurador - La aplicación de configuración (`gdmsetup`).

GDM - Gestor de pantallas de Gnome. Se usa para describir el paquete de software como un todo. algunas veces también se refiere a él como GDM2.

dgm - El demonio del gestor de pantallas (`gdm`).

Interfaz de entrada - La venta de de entrada gráfica (`gdmlogin` o `gdmgreeter`).

Interfaz de entrada GTK+ - La ventana de entrada estándar ( `gdmlogin`).

PAM - Pluggable Authentication Mechanism

Interfaz de entrada con temas - La ventana de entrada con temas intercambiables ( `gdmgreeter`).

XDMCP - X Display Manage Protocol

Las rutas que comienzan con una palabra entre los símbolos paréntesis angulosos son relativas al prefijo de instalación. Ej: `<share>/pixmaps/` se refiere a `/usr/share/pixmaps` si GDM se ha configurado con `--prefix=/usr`. Normalmente también denota que GDM está instalado con `--sysconfigdir=/etc/X11`, que quiere decir que cualquier ruta a la que se refiera como `<etc>/gdm/PreSession` usualmente significa `<etc/X11>/gdm/PreSession`. note que para interoperatibilidad se recomienda que use un prefijo de `/usr` y un directorio de configuración del sistema (--sysconfdir) `/etc/X11`.

## Vista general

### Introducción

El Gestor de pantallas de GNOME (GDM) es un gestor de pantallas que implementa todas las características significantes requeridas para gestionar pantallas remotas y locales. GDM se ha escrito desde cero y no contiene nada de código de XDM / X Consortium.

Para más información acerca de GDM, vea el sitio web del proyecto GDM. Por favor envíe cualquier informe de fallos o peticiones de mejoras a la categoría «gdm» en bugzilla.gnome.org. También puede enviar un mensaje a la lista de correo

    gdm-list@gnome.org

para hablar sobre cualquier problema o preocupación con el programa GDM.

### Estabilidad de interfaces

Los valores de pares de clave/valor definidos en los archivos de configuración de GDM y la ubicación de estos archivos se consideran «estables» y deberían cambiar sólo de formas compatibles hacia atrás. Note que esto incluye funcionalidad como los scripts de GDM (Init, PreSession, PostSession, PostLogin, XKeepsCrashing, etc), ubicaciones de directorios (ServAuthDir, PidFile, etc), aplicaciones del sistema (SoundProgram), etc. Algunos valores de configuración dependen de interfaces del SO y quizá necesiten ser modificados para que funcionen en un determinado SO. Los ejemplos típicos son HaltCommand, RebootCommand, SuspendCommand, StandardXServer, Xnest, SoundProgram, y el valor del «comando» para cada «server-tal».

Nota: las distribuciones a menudo cambian los valores predeterminados de las claves para soportar su plataforma. Los interfaces de línea de comandos para los programas GDM instalados en `<bin>` y `<sbin>` se consideran estables. Refiérase a su documentación de la distribución para ver si hay cualquier cambio específico de la distribución a estos interfaces de GDM y qué soporte existe para ellos.

As of the GDM 2.15 development series, some one-dash arguments are no longer supported. This includes the "-xdmaddress", "-clientaddress", and "-connectionType" arguments used by `gdmchooser`. These arguments have been changed to now use two dashes.

Si se descubrieran problemas que rompiesen la compatibilidad, por favor envíe un error con una prioridad «urgente».

### El demonio GDM

El demonio GDM es responsable de gestionar pantallas en el sistema. Esto incluye la autenticación de usuarios, iniciar la sesión del usuario y terminar la sesión del usuario. GDM es configurable y las formas en que puede configurarse se describen en la sección «Configurar GDM» de este documento. Los scripts `Init`, `PostLogin`, `PreSession`, y `PostSession` de los que se habla más abajo se tratan en esta sección «Configurar GDM».

El demonio de GDM soporta un protocolo de sockets de dominio UNIX que puede usarse para controlar aspectos de su comportamiento y para solicitarle información. Este protocolo se describe en la sección «Controlar GDM» de este documento.

A GDM se le puede pedir que gestione una pantalla de varias formas. Las pantallas locales las gestiona siempre GDM cuando se inicia y serán reiniciadas cuando la sesión de un usuario termine. Las pantallas pueden pedirse además por XDMCP, se pueden pedir pantallas flexibles ejecutando el comando `gdmflexiserver`. Las pantallas que se inician bajo demanda no se se reinician al salir de la sesión. GDM también proporciona el comando `gdmdynamic` para permitir una gestión más fácil de las pantallas en un servidor multiusuario. Estos tipos de pantallas se discuten en la sección siguiente.

Cuando se le pide al demonio GDM que gestione una pantalla, bifurcará un proceso servidor de X, después ejecutará el script `Init` como el usuario root, e iniciará el diálogo de entrada como un proceso esclavo en la pantalla. GDM puede configurarse para usar o bien `gdmgreeter` (predeterminado) o `gdmlogin` como programa de IGU para la entrada. El programa `gdmlogin` soporta accesibilidad mientras que el programa `gdmgreeter` soporta mayor temabilidad. El diálogo de la IGU se ejecuta como el usuario/grupo no privilegiado «gdm» que se describe en la sección «Seguridad» abajo. El diálogo del IGU se comunica con el demonio por medio de un protocolo de sockets y por medio de la entrada/salida estándar. El esclavo, por ejemplo pasa el nombre del usuario y la contraseña al demonio GDM por medio de la entrada/salida estándar así que el demonio puede manipular la autenticación actual.

La pantalla del GUI de la entrada permite al usuario seleccionar qué sesión quiere iniciar y qué idioma quiere usar. Las sesiones se definen por archivos que terminan con la extensión .desktop y puede encontrar más información sobre estos archivos en la sección de «Configuración». El usuario ontroduce su nombre y contraseña y si éstos le autentican con éxito, GDM iniciará la sesión solicitada para el usuario. Es posible configurar GDM para evitar el proceso de autenticación activando las características de Entrada automática o Entrada temporizada en la configuración de GDM. El IGU de entrada puede configurarse además para para proporcionar características adicionales al usuario, como un visor de rostros, la capacidad de detener, reiniciar o suspender el sistema; y o editar la configuración de entrada (tras introducir la contraseña de root).

GDM, por omisión, usará Pluggable Authentication Modules (PAM) para autenticar, pero puede usar además contraseñas crypt y shadow en sistemas legados. Tras autenticar al usuario, el demonio ejecuta el script `PostLogin` como root, y bifurca un proceso esclavo para iniciar la sesión solicitada. Este proceso esclavo ejecuta el script de `PreSession` como root, establece el entorno del usuario e inicia la sesión solicitada. GDM conserva la sesión predeterminada del usuario y el idioma en el archivo `~/.dmrc` del usuario y usará estos predeterminados si el usuario no seleccionó una sesión o idioma en el IGU de entrada. En Solaris, GDM (desde la version 2.8.0.3) usa el interfaz SDTLOGIN después de autenticar al usuario para decir al servidor X que se reinicie como el usuario en vez de como root para mayor seguridad. Cuando la sesión del usuario sale, el demonio de GDM ejecutará el script `PostSession` como root.

### Tipos de pantalla diferentes

GDM soporta tres tipos de pantalla diferentes: pantallas estática (local), pantallas flexibles (bajo demanda), y pantallas remotas (XDMCP). Las subsecciones «Definiciones del servidor X» y «Configuración de pantalla X local estática» de la sección «Configuración» explican cómo estos tipos de pantallas se definen en el archivo de configuración de GDM.

Las pantallas locales estáticas siempre se inician por el demonio, y cuando mueren o se les mata, se reinician. GDM puede ejecutar tantos como se necesiten. GDM puede gestionar además servidores en los cuales no gestiona la entrada él mismo, permitiendo usar GDM para soportar terminales X.

Las pantallas flexibles o bajo demanda, se inician por medio del protocolo socket con el comando `gdmflexiserver`. Esta característica sólo está disponible para los usuarios que hayan entrado en la consola y mostrará una pantalla de entrada nueva. Si una pantalla flexible se ha iniciado anteriormente en la consola, ejecutando `gdmflexiserver` de nuevo se mostrará un menú permitiendo a los usuarios volver a la sesión existente o iniciar una nueva sesión flexible. El comando `gdmflexiserver` bloquea la sesión actual antes de iniciar una pantalla flexible nueva, así que debe introducirse la contraseña del usuario antes de volver a la sesión existente. El comando `gdmflexiserver` puede usarse además para lanzar pantallas anidadas con `Xnest`. Éstas se lanzan en una ventana en la sesión actual del usuario. Las pantallas anidadas pueden iniciarse incluso si no se ha entrado en la consola y se inician ejecutando el comando `gdmflexiserver -n`. Las pantallas flexibles no se reinician cuando la sesión termina. Las pantallas flexibles requieren soporte de terminales virtuales en el núcleo, y no estarán disponibles si no están soportados (como en Solaris). Las pantallas anidades requieren que el servidor X soporte Xnest.

El último tipo es la pantalla remota XDMCP que se describe en la siguiente sección. Los equipos remotos pueden conectarse a GDM y presentar la pantalla de entrada si esto está activado. Algunas cosas son diferentes para las sesiones remotas. Por ejemplo, el menú Acciones que permite apagar, reiniciar o configurar GDM no se mostrará.

Las pantallas iniciadas por medio del comando `gdmdynamic` se tratan como pantallas locales, así que se reinician automáticamente cuando la sesión termina. Este comando está pensado para gestionar más efectivamente las pantallas en un servidor multi-usuario (muchas pantallas conectadas a un solo servidor).

### XDMCP

El demonio GDM puede configurase para escuchar y gestionar las solicitudes del protocolo X Display Manage Protocol (XDMCP) de las pantallas remotas. Por omisión el soporte para XDMCP está desactivado, pero puede activarse si se desea. Si GDM está construido con soporte TCP Wrapper, entonces el demonio sólo permitirá acceder a hosts especificados en la sección de servicio GDM en el archivo de configuración de TCP Wrappers.

GDM incluye varias medidas para hacerlo más resistente a ataques de denegación de servicio en el servicio XDMCP. Muchos de los parámetros del protocolo, tiempos de espera negociación, etc pueden ajustarse finamente. Sin embargo la configuración de fábrica debería funcionar en la mayoría de sistemas. No la cambie a menos que sepa lo que está haciendo.

GDM escucha en el puerto UDP 177 y responderá a las peticiones QUERY y BROADCAST_QUERY enviando un paquete WILLING al originador.

GDM también puede configuarse para confiar en solicitudes INDIRECT y presentar un selector de equipos al display remoto. GDM recordará la selección del usuario y reenviará las peticiones subsiguiente al gestor seleccionado. GDM también soporta una extensión al protocolo que hará que se olvide de la redirección una vez que la conexión del usuario tiene éxito. Esta extensión está soportada sólo si ambos demonios son GDM. Es transparente y será ignorada por XDM u otros demonios que implementan XDMCP.

Refiérase a la seccion «Seguridad» para información acerca de las preocupaciones de seguridad al usar XDMCP.

### Securización de la conexión remota a través de SSH

Tal como se explica en la sección «Seguridad», XDMCP no usa ninguna clase de encriptación y debido a esto es inherentemente inseguro. Como XDMCP usa UDP como capa de transporte de red, no es posible simplemente securizarla por medio de un túnel SSH.

Para remediar este problema, gdm puede configurarse en tiempo de compilación con la opción .--enable-secureremote, con la cual gdm propone como una sesión integrada una sesión llamada «Conexión remota segura». Iniciando dicha sesión permite al usuario introducir el nombre o la dirección del equipo en el que quiere conectarse, siempre que dicho host ejecute un servidor SSH, el usuario entonces obtiene una conexión al servidor en la cual la sesión X predeterminada se inicia y muestra en el host local.

Usar esta sesión permite una conexión de red mucho más segura y sólo necesita tener un servidor SSH ejecutándose en el host remoto.

### El interfaz GTK+

El interfaz GTK+ es el interfaz gráfico de usuario predeterminado que se presenta al usuario. El interfaz contiene un menú en la parte superior, un visor de rostros opcional, un logo opcional y un widget para entrada de texto. Este interfaz tiene soporte de accesibilidad completo, y debería usarse por los usuarios con necesidades de accesibilidad.

El campo de entrada de texto se usa para introducir nombres de usuario, contraseñas, etc. `gdmlogin` está controlado por un demonio por debajo que es básicamente sin estado. El demonio controla el interfaz a través de un protocolo simple donde puede pedir al interfaz una cadena de texto con eco activado o desactivado. Similarmente, el demonio puede cambiar la etiqueta sobre la entrada de texto para corresponder con el valor que el sistema de autenticación quiere que el usuario introduzca.

La barra del menú en la parte superior del interfaz de entrada permite al usuario seleccionar el tipo sesión/entorno de escritorio solicitado, seleccionar un idioma/configuración regional apropiada y opcionalmente apagar/reiniciar/suspender el equipo, configurar GDM (siempre que el usuario conozca la contraseña de administrador), cambiar el tema GTK+ o iniciar un selector XDMCP.

El interfaz de entrada puede mostrar opcionalmente un logotipo en la ventana de entrada. La imagen debe estar en un formato legible por la biblioteca gdk-pixbuf (GIF, JPG, PNG, TIFF, XPM y posiblemente otros), y debe tener permiso de lectura para el usuario de GDM. Vea la opción `Logotipo` en la sección de referencia inferior para los detalles.

### El interfaz con temas

The Themed Greeter is a greeter interface that takes up the whole screen and is very themable. Themes can be selected and new themes can be installed by the configuration application or by setting the `GraphicalTheme` configuration key. The Themed Greeter is much like the GTK+ Greeter in that it is controlled by the underlying daemon, is stateless, and is controlled by the daemon using the same simple protocol.

La apariencia de este interfaz está controlada realmente por el tema y así los elementos del interfaz de usuario que están presentes pueden ser diferentes. La única cosa que debe estar presente siempre es el campo de entrada de texto tal como se describe arriba en el interfaz GTK+. El tema puede incluir botones que permitan al usuario seleccionar la configuración reginal o idioma adecuado, detener/reiniciar/suspender el equipo, configurar GDM (siempre que el susuario conozca la contraseña de root), o iniciar un selector XDMCP.

Puede obtener siempre un menú de las acciones disponibles pulsando la tecla F10. Esto puede ser útil si el tema no proporciona ciertos botones cuando realmente quiere hacer alguna acción permitida por la configuración de GDM.

### El visor de rostros de GDM

GDM soporta un visor de rostros que mostrará una lista de usuarios que pueden entrar y un icono para cada usuario. Esta característica puede usarse con el interfaz GTK+ si la opción de configuración `Examinador` está establecida a "true". Esta característica puede usarse con el Interfaz con Temas si usa un tema de GDM que incluya un tipo de elemento "userlist", tal como "happygnome-list"

Por omisión, el visor de rostros está desactivado debido a que revelar nombres de usuario en la pantalla de entrada no es apropiado en muchos sistemas por razones de seguridad. Además GDM requiere alguna configuración para especificar qué usuarios deberían ser visibles. La configuración puede hacerse en la solapa «Usuarios» en `gdmsetup`. Esta característica es más práctica de usar en un sistema con un número pequeño de usuarios.

Los iconos usados por GDM pueden instalarse globalmente por el administrador del sistema o pueden colocarse en los directorios personales de los usuarios. Si se instalan globalmente deberían estar en el directorio `<share>/pixmaps/faces/` (aunque esto puede configurarse con la opción `GlobalFaceDir`) y el nombre del archivo debería ser el nombre del usuario, opcionalmente con un `.png` agregado. Los iconos de caras colocados en el directorio global de caras deben ser legibles por el usuario de GDM. Sin embargo, el demonio, proximiza las imágenes de los usuarios al interfaz y debido a esto no tienen que ser legibles por el usuario «gdm» sino por el root.

Los usuarios pueden ejecutar el comando `gdmphotosetup` para configurar la imagen a usar para su id de usuario. Este programa escala apropiadamente el archivo si es más grande que las opciones de configuración `MaxIconWidth` o `MaxIconHeight` y coloca al icono en un archivo llamado `~/.face`. Aunque `gdmphotosetup` escala las imágenes del usuario automáticamente, esto no garantiza que esas imágenes de usuario estén escaladas de forma adecuada así que un usuario puede crear su archivo `~/.face` a mano.

GDM primero buscará la imagen de la cara del usuario en `~/.face`. Si no la encuentra, intentará con `~/.face.icon`. Si aún no la encuentra, usará el valor definido para "face/picture=" en el archivo `~/.gnome2/gdm`. Por último intentará con `~/.gnome2/photo` y `~/.gnome/photo` los cuales están obsoletos y se soportan por compatibilidad hacia atrás.

Si un usuario no tiene una imagen de rostro definida, GDM usará el icono "stock_person" definido en el tema GTK+ actual. Si dicha imagen no está definida, entonces usará la imagen especificada en la opción de configuración `DefaultFace` como resguardo, normalmente `</share>/pixmaps/nobody.png`.

Note que cargar y escalar los iconos de rostros situados en los directorios personales de los usuarios puede ser una tarea que consuma mucho tiempo. Debido a que no es práctico cargar imágenes sobre NIS o NFS, GDM no intenta cargar imágenes de rostros desde directorios personales remotos. Además, GDM parará de cargar imágenes de rostros después de 5 segundos de actividad y sólo mostrará los usuarios cuyas imágenes haya obtenido hasta entonces. La opción `Include` de `gdm.conf` puede usarse para especificar un conjunto de usuarios que deberían aparecer en el visor de rostros. Mientras los usuarios a incluir tengan un tamaño razonable, no debería haber ningún problema con GDM siendo incapaz de acceder a las imágenes de rostros. Para evitar estos problemas, se recomienda situar las imágenes de rostros en el directorio especificado por la opción de configuración `GlobalFaceDir`.

Para controlar qué usuarios se muestran en el examinador de rostros, hay varias opciones de configuración que pueden usarse. Si se establece a true la opción `IncludeAll`, entonces se analizará el archivo de contraseñas y se mostrarán todos los usuarios. Si la opción `IncludeAll` se establece a falso, entonces la opción `Include` debería contener una lista de usuarios separada por comas. Sólo los usuarios especificados se mostrarán. Cualquier usuario listado en la opción `Exclude` y los usuarios cuyo UID sea inferior a `MinimalUID` se filtrarán con independencia de lo que esté establecido en `IncludeAll`. `IncludeAll` no está recomendado para sistemas donde las contraseñas se carguen por mdio de una red (como cuando se usa NIS), debido a que puede ser muy lento cargar más de un pequeño número de usuarios sobre la red.

Cuando el examinador está activado, los nombres de usuario válidos en el equipo están expuestos inherentemente a un intruso potencial. Esto puede ser una mala idea si no sabe quién puede acceder a una pantalla de entrada. Esto es especialmente cierto si ejecuta XDMCP (desactivado por omisión).

### Registro de actividad

GDM por sí mismo usará syslog para registrar los errores o el estado. También puede registrar información de depuración, que puede ser útil para encontrar problemas si GDM no funciona apropiadamente. Esto puede activarse en el archivo de configuración.

La salida de varios servidores X está almacenada en el directorio de registros de GDM, el cual es configurable, pero normalmente es `/var/log/gdm/`. La salida desde la sesión puede encontrarse en un archivo llamado `<display>.log`. Cuatro archivos más antiguos se almacenan también con `.1` a `.4` anexado. Éstos se rotarán a medida que se inicien nuevas sesiones en esa pantalla. Puede usar estos registros para ver que decía el servidor X cuando arrancaba.

La salida de la sesión de usuario está redirigida a `~/.xsession-errors` incluso antes de se inicie el script `PreSession`. Así que no es realmente necesario redirigir esto otra vez en el script de configuración de la sesión. Tal como se hace normalmente, si la sesión del usuario duró menos de 10 segundos, GDM asume que la sesión reventó y permite al usuario ver este archivo en un diálogo antes de volver a la pantalla de entrada. De esta manera el usuario puede ver los errores de la última sesión y corregir el problema.

Puede suprimir la advertencia de los 10 segundos devolviendo un código 66 desde el script `Xsession` desde el binario de la sesión (el script `Xsession` predeterminado propaga esos códigos hacia atrás). Esto es útil si tiene alguna clase de inicios de sesión especiales para los que no es un error retornar menos de esos 10 segundos después, o si configura la sesión para mostrar algún mensaje de error y el mensaje de GDM podría ser confuso y redundante.

La salida de la sesión se encauza a través del demonio gdm y así el archivo `~/.xsession-errors` está capado a cerca de 200 Kbytes por GDM para prevenir una posible denegación de servicio en la sesión. Una aplicación podría quizás leer algunos datos erróneos, imprimir advertencias o errores en stderr o stdout. Esto podría quizás llenar el directorio personal del usuario quien tendría que cerrar sesión e iniciar sesión de nuevo para limpiar esto. Esto podría ser especialmente duro si hay cuotas puestas. GDM además atrapa correctamente la señal XFSZ y para de escribir el archivo, lo que podría conducir a sesiones matadas si el archivo fue redirigido en la forma antigua desde el script.

Note que algunos distribuidores parecen ignorar la redirección de `~/.xsession-errors` y la hacen ellos mismos en su propio script Xsession (establecido por la clave de configuración `BaseXsession`) que significa que GDM no será capaz de atrapar la salida y cubrir este archivo. Puede también perder datos de salida del script `PreSession` lo que puede hacer la depuración mucho más complicada ya que quizás la salida de lo que está equivocado no se imprimirá. Vea la descripción de la clave de configuración `BaseXsession` para más información, especialmente acerca de cómo manejar múltiples gestores de entrada usando el mismo script.

Note que si la sesión es una sesión a prueba de fallos, o si GDM no puede abrir este archivo por alguna razón, entonces se creará un archivo de apoyo en el directorio `/tmp` llamado `/tmp/xses-<user>.XXXXXX` donde `XXXXXX` son caracteres aleatorios.

Si ejecuta un sistema sin cuotas activadas, será bueno borrar el archivo `~/.xsession-errors` en el script `PostSession`. Así este archivo de registro no está por medio innecesariamente.

### Acceder a archivos

En general GDM es muy reluctante respecto a leer/escribir archivos del usuario (como `~/.dmrc`, `~/.face`, `~/.xsession-errors`, y `~/.Xauthority`). Por ejemplo, se niega a acceder a cualquier cosa que no sean archivos regulares. Los enlaces, sockets y dispositivos se ignoran. El valor del parámetro `RelaxPermissions` determina si GDM debe aceptar archivos escribibles por el grupo del usuario u otros. Éstos se ignoran por omisión.

Todas las operaciones en los archivos de usuario se realizan con el id efectivo del usuario. Si el control de sanidad falla en el archivo `.Xauthority` del usuario, se crea una cookie de resguardo en el directorio especificado por la opción de configuración `UserAuthFBDir` (`/tmp` por omisión).

Finalmente, el administrador del sistema puede especificar el tamaño máximo del archivo que GDM debería aceptar y, en el caso de que el visor de rostros esté activado, se fuerza un tamaño máximo del icono. En sistemas grandes se avisa además que desactive el visor de rostros por razones de rendimiento. Mirar iconos en directorios personales, escalarlos y renderizarlos puede llevar mucho tiempo.

### Rendimiento de GDM

Para acelerar el rendimiento es posible construir GDM para que precargue las bibliotecas cuando el GDM muestre un programa de entrada por primera vez. Esto se ha mostrado para acelerar el primer inicio de sesión debido a que estas bibliotecas pueden cargarse en memoria mientras el usuario teclea su nombre y contraseña.

To use this feature, configure GDM with the `--with-prefetch` option. This will cause GDM to install the `gdmprefetch` program to the `libexecdir` directory, install the `gdmprefetchlist` to the `<etc>/gdm` directory, and set the `PreFetchProgram` configuration variable so that the `gdmprefetch` program is called with the default `gdmprefetchlist` file. The default `gdmprefetchlist` file was optimized for a GNOME desktop running on Solaris, so may need fine-tuning on other systems. Alternative prefetchlist files can be contributed to the "gdm" category in bugzilla.gnome.org, so that they can be included in future GDM releases.

## Seguridad

### PAM

GDM uses PAM for login authentication, though if your machine does not support PAM you can build GDM to work with the password database and the crypt library function.

PAM stands for Pluggable Authentication Module, and is used by most programs that request authentication on your computer. It allows the administrator to configure different authentication behavior for different programs.

Some GDM features (like turning on automatic login) may require that you update your PAM configuration. PAM configuration has different, but similar, interfaces on different operating systems, so check your pam.d or pam.conf man page for details. Be sure that you read the PAM documentation (e.g. pam.d/pam.conf man page) and are comfortable with the security implications of any changes you intend to make to your configuration.

If there is no entry for GDM in your system's PAM configuration file, then features like automatic login may not work. Not having an entry will causes GDM to use default behavior, conservative settings are recommended and probably shipped with your distribution.

If you wish to make GDM work with other types of authentication mechanisms (such as a SmartCard), then you should implement this by using a PAM service module for the desired authentication type rather than by trying to modify the GDM code directly. Refer to the PAM documentation on your system. This issue has been discussed on the

    gdm-list@gnome.org

mail list, so you can refer to the list archives for more information.

### El usuario GDM

Por razones de seguridad se requieren un usuario y grupo dedicado para un funcionamiento correcto. La necesidad de ser capaz de escribir archivos Xauth es el porqué el usuario «nobody» no es apropiado para gdm.

El demonio GDM normalmente se ejecuta como root, y hace de esclavo. Sin embargo GDM debería también tener un id de usuario y un id de grupo dedicado que se usa para sus interfaces gráficas `gdmgreeter` y `gdmlogin`. Éstos se configuran por medio de las opciones de configuración `User` y `Group` en los archivos de configuración de GDM. El usuario y grupo debería ser creado antes de ejecutar «make install». Por omisión GDM asume que el usuario y el grupo se llaman «gdm».

Este id de usuario se usa para ejecutar los programas del IGU de GDM requeridos para la entrada. Toda la funcionalidad que requiere la autorización de root la realiza el proceso del demonio GDM. Este diseño asegura que si los programas del IGU son comprometidos, sólo los privilegios del usuario dedicado están disponibles.

Debería notarse sin embargo que el usuario y el grupo de GDM tienen algunos privilegios que los hacen de alguna manera peligrosos. Por una parte tienen acceso al directorio de autorización del servidor X. Debe ser capaz de leer y escribir claves Xauth en `<var>/lib/gdm`. Este directorio debería tener como propietario root:gdm y permisos 1770. Ejecutar «make install» establecerá este directorio a estos valores. El proceso del demonio de GDM restablecerá este directorio a los permisos/propietario adecuados si por cualquier circunstancia, no estuvieran establecidos de forma correcta.

El peligro es que alguien que gane privilegios del usuario/grupo GDM puede entonces conectarse a cualquier sesión. Así que no debería bajo ninguna circunstancia, hacer esto a algún usuario/grupo que pueda ser fácil obtener acceso, como el usuario `nobody`. Los usuarios que ganan acceso al usuario «gdm» podrían también modificar las claves Xauth y provocar ataques de denegación de servicio. También si una persona gana la capacidad de ejecutar programas como el usuario «gdm», podría ser posible espiar los procesos GDM en ejecución, incluyendo usuarios y contraseñas a medida que se teclean.

Se espera que las distribuciones y los administradores de sistemas que usen GDM configuren el usuario dedicado de forma apropiada. Se recomienda que este id de usuario se configure para no permitirle iniciar sesión y no tener un intérprete de comandos predeterminado. Las distribuciones y los administradores del sistema deberían configurar el sistema de archivos para asegurarse de que el usuario GDM no tenga permiso de lectura o escritura a los archivos sensibles.

### Esquema de autenticación del servidor X

El directorio de autorización del servidor (el `ServAuthDir`) se usa para albergar un conjunto de datos aleatorios internos además de los archivos de autorización del servidor X, y el nombre es realmente una reliquia de la historia. El demonio GDM fuerza que este directorio tenga el propietario `root.gdm` con los permisos 1770. De esta manera sólo root y el grupo de GDM tienen acceso de escritura a este directorio, pero el grupo GDM no puede eliminar los archivos que sean propiedad de root de este directorio, tales como los archivos de autorización del servidor X.

GDM por omisión no confía en el directorio de autorización del servidor y lo trata de la misma manera que el directorio temporal respecto a crear archivos. De esta manera, alguien que rompa al usuario de GDM no puede montar ataques creando enlaces en este directorio. Similarmente el directorio de registros del servidor X se trata de forma segura, pero ese directorio debería ser propiedad y escribible sólo por el usuario root.

GDM sólo soporta el sistema de autenticación MIT-MAGIC-COOKIE-1. Normalmente se gana poco de otros esquemas, no se ha hecho ningún esfuerzo en implementarlos hasta ahora. Dea especialmente cuidadoso acerca de usar XDMCP porque las cookies de autenticación van sobre el cable como texto en claro.Obviamente si el espionaje es posible, entonces el atacante podría tan sólo espiar su contraseña de autenticación mientras usted inicia una sesion, con independencia del esquema de autenticación que se esté usando. Si el espionaje es posible y poco deseable, entonces tendrá que crear un túnel a través de ssh para la conexión X en vez de usar XDMCP. Podría pensar en XDMCP como una clase de telnet gráfico que tiene los mismos problemas de seguridad.

En el lado superior, la generación de números aleatorios de GDM es muy conservadora y GDM toma medidas extraordinarias para obtener un verdadero número aleatorio de 128 bits, usando generadores de números aleatorios por hardware si es posible, además de la hora actual (con precisión de microsegundos), un array de 20 bytes de números pseudoaleatorios, pids de procesos, además de otra información aleatoria (posiblemente usando `/dev/audio` o `/dev/mem` si los generadores aleatorios hardware no están disponibles) para crear un búfer grande y después ejecutar un digest MD5 en él. Obviamente, todo este trabajo se desperdicia si envía la cookie a través de una red abierta o la almacena en un directorio NFS (vea la clave de configuración de `UserAuthDir`). Así que sea cuidadoso acerca de dónde usa su display X remoto.

### Seguridad con cortafuegos

Incluso aunque GDM intenta diferenciar inteligentemente a los atacantes potenciales, se recomienda que bloquee el puerto XDMCP (normalmente el puerto UDP 177) en su cortafuegos a no ser que realmente lo necesite. GDM se protege contra ataques DoS, (Denial of Service) pero el protocolo X aún es inherentemente inseguro y sólo debería usarse en entornos controlados. Además cada conexión remota toma muchos recursos, así que es más fácil hacer un DoS a un servidor XDMCP que a un servidor web.

También es sabio bloquear todos los puertos del servidor X (puertos TCP 6000 + número de pantall) en el cortafuegos. Note que GDM usará los números de pantalla 20 y superiores para los servidores flexibles bajo demanda.

X no es un protocolo muy seguro para dejarlo en la red, y XDMCP es incluso menos seguro.

### Seguridad de GDM con NFS

Note que el tráfico NFS realmente va "sobre el cable" y puede verse. Cuando se acceda al archivo de autorización X del usuario (`~/.Xauthority`), GDM intentará abrir el archivo para leerlo como root. Si falla, GDM concluirá que se ha montado por NFS y usará automáticamente `UserAuthFBDir`, que usualmente está en `/tmp`. Este comportamiento puede cambiarse poniendo a «false» `NeverPlaceCookiesOnNFS` en la sección `[security]`.

### Seguridad XDMCP

Incluso aunque su pantalla esté protegida por cookies, XEvents y las pulsaciones de teclas que se introducen al escribir las contraseñas aún irán sobre el cable en texto claro. Es trivial capturarlas.

XDMCP es útil principalmente para ejecutar clientes ligeros como en terminales de laboratorio. Dichos clientes ligeros sólo necesitarán la red alguna vez para acceder al servidor, y así parece que la mejor poítica para la seguridad es tener a esos clientes ligeros en una red separada que no pueda accederse desde el mundo exterior, y sólo pueda conectarse al servidor. El único punto desde el que necesita acceder desde fuera es el servidor.

Las secciones de arriba «Esquema de autenticación del servidor X» y «Seguridad con cortafuegos» también contienen información importante acerca de usario XDMCP de forma segura. La siguiente sección también discute cómo configurar el control de acceso de XDMCP.

Para solucionar la seguridad inherente de XDMCP, gdm propone una sesión predeterminada integrada que usa ssh para encriptar la conexión remota. Vea la sección «Securizar una conexión remota con ssh» arriba.

### Control de acceso XDMCP

El control de acceso XDMCP se realiza usando TCP wrappers. Es posible compilar GDM sin TCP wrappers sin embargo, así que debería comprobar su configuración y verificar que funciona.

Debería usar el nombre del demonio `gdm` en el archivo `<etc>/hosts.allow` y en el archivo `<etc>hosts.deny`. Por ejemplo para denegar la entrada a equipos de `.evil.domain` , añada

    gdm: .dominio.maligno

a `<etc>/hosts.deny`. También necesitará añadir

    gdm: .su.dominio

a su `<etc>/hosts.allow` si normalmente no permite todos los servicios desde todos los equipos. Vea la página del manual hosts.allow(5) para más detalles.

## Using gdmsetup To Configure GDM

The `gdmsetup` application can be used to configure GDM. If you believe running root-owned GUI's causes security risk, then you would want to always edit the files by hand and not use `gdmsetup`. Editing the files by hand is explained in the "Configuration" section of this document. Note that `gdmsetup` does not support changing of all configuration variables, so it may be necessary to edit the files by hand for some configurations.

The `gdmsetup` program has five tabs: Local, Remote, Accessibility, Security, and Users, described below. In parenthesis is information about which GDM configuration key is affected by each GUI choice. Refer to the "Configuration" section of this manual and the comments in the <share>/gdm/defaults.conf file for additional details about each key.

### Local Tab

The Local tab is used for controlling the appearance of GDM for local/static displays (non-XDMCP remote connections). The choices available in this tab depend on the setting of the "Style" combobox. This combobox is used to determine whether the "Plain" or "Themed" greeter GUI is used. The differences between these greeter programs are explained in the "Overview" section of this document.

If the "Style" choice is "Plain", then GDM will use the `gdmlogin` program as the GUI (daemon/Greeter). When this choice is selected, `gdmsetup` allows the user to select whether the background is an image or solid color (greeter/BackgroundType). If image is selected, there is a file selection button to pick the image file (greeter/BackgroundImage) and a checkbox to scale the image to fit the screen (greeter/BackgroundImageScaleToFit). If solid color is selected, there is a button available to allow the color selection (greeter/BackgroundColor). Also, the user may select the logo image that appears in gdmlogin (greeter/Logo).

If the "Style" choice is "Plain with face browser", then the `gdmlogin` program is used as the GUI (daemon/Greeter) and the face browser is turned on (greeter/Browser). The Face Browser is explained in the Overview section. Otherwise, the choices are the same as when the "Style" choice is "Plain". Additional setup in the Users tab may be necessary to choose which users appear in the Face Browser.

If the "Style" choice is "Themed", then the `gdmgreeter` program is used as the GUI (daemon/Greeter). When this choice is selected, `gdmsetup` allows the user to select the theme to be used (greeter/GraphicalTheme). Note that the checkbox to the left of the theme's name must be checked for a theme to be selected. Clicking on the theme, but not selecting the checkbox will highlight the theme and the "Remove" button can be used to delete the theme. Information about the theme's author and copyright are shown for the highlighted theme. The "Add" button can be used to add new themes to the system. To turn on the Face Browser, a theme which includes a Face Browser must be selected, such as happygnome-list. The "Background color" displayed when GDM starts (and if the theme has transparent elements) can also be selected (greeter/GraphicalThemedColor). The "Theme" combo box may be set to "Random from selected" if you want a random theme to be used for each login (greeter/GraphicalThemeRand and greeter/GraphicalThemes). To use random themes, select each theme that you wish to be used. By default this combobox is set to "Selected only", so that only a single theme can be selected and be used.

Regardless of the "Style" choice, the user may also select whether the Actions menu is visible (greeter/SystemMenu), whether the Actions menu includes the choice to start `gdmsetup` (greeter/ConfigAvailable), and whether the Action menu includes the choice to start `gdmchooser` to run a remote XDMCP login session (greeter/ChooserButton). Note that the root password must be entered to start `gdmsetup` from the login screen if it is enabled. Also the Welcome message displayed for local sessions may be selected (greeter/DefaultWelcome and greeter/Welcome). The Welcome message can contain the character sequences described in the "Text Node" section of the "Themed Greeter" section of this manual.

### Remote Tab

The Remote tab controls the appearance of the GDM for users logging in via XDMCP. By default XDMCP is disabled, and users should be comfortable with the XDMCP-related sections of the Security section of this document before enabling it. This tab includes a "Style" combobox which can be used to turn on XDMCP and control the appearance of GDM for remote users (gui/RemoteGreeter and xdmcp/Enable). This combobox may be set to "Remote login disabled" or "Same as Local". If the Local tab is set to "Plain" or "Plain with Face Browser", then the user may also select "Themed". If the Local tab is set to "Themed", then the user may also select "Plain" or "Plain with face browser". It is recommended that the "Plain" GUI be used for remote connections since it is more lightweight and tends to have better performance across a network.

If Remote login is enabled, then the user can specify the remote Welcome Message to be displayed (greeter/DefaultRemoteWelcome and greeter/RemoteWelcome). This welcome message is separate from the Local welcome message and can have a different value. The Welcome message can contain the character sequences described in the "Text Node" section of the "Themed Greeter" section of this manual.

If the "Style" choice is "Same as Local" and the local selection is "Plain" or "Plain with face browser", then the user may select whether background images should be displayed for remote logins (greeter/BackgroundRemoteOnlyColor).

If the "Style" choice is enabled and set to a different value than the Local tab, then the user has the same configuration choices as found on the Local tab except that the System Menu choices are not available since this is never available for remote logins for security purposes.

If Remote login is enabled, there is a "Configure XDMCP" button which displays a dialog allowing the user to set XDMCP configuration, including whether indirect requests are honored (xdmcp/HonorIndirect), UDP port (xdmcp/Port), maximum pending requests (xdmcp/MaxPending), maximum pending indirect requests (xmdcp/MaxPendingIndirect), maximum remote sessions (xdmcp/MaxSessions), maximum wait time (xdmcp/MaxWait), maximum indirect wait time (xdmcp/MaxWaitIndirect), displays per host (xdmcp/DisplaysPerHost), and ping interval (xdmcp/PingIntervalSeconds). The default settings are standard settings and should only be changed by someone who understands the ramifications of the change.

### Accessibility Tab

The Accessibility tab is used to turn on Accessibility features in GDM. "Enable accessible login" (daemon/AddGtkModules and daemon/GtkModulesList) turns on GDM's gesture listeners which are explained in the "Accessibility" section of this document. There is also a checkbox to allow users to change the theme when using the Plain greeter (gui/AllowGtkThemeChange). This feature allows GDM users to switch the theme to the HighContrast or LowContrast themes if needed. The user may also select whether GDM should play a sound when the login screen is ready, when login is successful and when login has failed. File chooser buttons are used to select the sound file to be played, and the "Play" button can be used to sample the sound.

### Security Tab

The Security tab allows the user to turn on Automatic and Timed login, which user is logged in via an automatic or timed login, and the timed login delay (daemon/AutomaticLoginEnable, daemon/AutomaticLogin, daemon/TimedLoginEnable, daemon/TimedLogin, and daemon/TimedLoginDelay). If automatic login is turned on, then the specified user will immediately log in on reboot without GDM asking for username/password. If the user logs out of their session, GDM will start and ask for username and password to log back in. If TimedLogin is turned on, then GDM will log in to the specified user after a specified number of seconds. The user may enable Timed Login for remote (XDMCP) connections by checking the "Allow remote timed logins" checkbox.

On this tab, the user may select whether the system administrator user can log in, and whether the system administrator user can log in via remote (XDMCP) connections (security/AllowRoot and security/AllowRemoteRoot). The user may turn on GDM debug (debug/Enable) which causes debug messages to be sent to the system log. Debug should only be used when diagnosing a problem and not be left on when not needed. The "Deny TCP connections to Xserver" choice will disable X forwarding if selected (security/DisallowTCP). A login retry delay (security/RetryDelay) can be set to cause GDM to wait a number of seconds after a failed login.

The "Configure X Server" button can be used to specify how GDM manages each display. The "Servers" combobox shows what server definitions are available (Standard, Terminal, and Chooser by default). Refer to the "X Server Definitions" section of the "Configuration" section for more information about how to create new Server Definitions.

For any server type, the user may modify the "Server Name" (server/name), the "Command" (server/command) to be used to launch the Xserver, whether the server type will "Launch" (server/chooser) the greeter or chooser GUI after starting the Xserver, whether GDM handles this type (normally only set to false when logging into a Terminal session type), and whether the session type supports "Flexible" (server/flexible) sessions.

The "Servers To Start" section shows what server type is displayed for each display on the machine. Users may click on the "Add/Modify" button to add a new display to the list or to modify a selected display. This simply corresponds each physical display with the Server Definition to be used for managing that display. The "Remove" button may be used to remove a display from the list.

### Users Tab

The Users tab controls which users appear in the Face Browser. If the "Include all users from /etc/password" checkbox is selected, then all users (with a userid above greeter/MinimalUID and not in the Exclude list) are displayed. If this checkbox is not selected, then users must be added to the "Include" list. Users in the "Exclude" list are never displayed. The "Add" and "Remove" buttons are used to add a new user to the list or remove a selected user from the list. The "Apply User Changes" button must be pressed after the "Include" and "Exclude" lists have been modified. The left and right arrow buttons between the "Include" and "Exclude" lists can be used to move a selected user from one list to the other.

## Configuración

GDM has powerful configuration management. System configuration is stored in `<share>/gdm/defaults.conf` and the intention is that this file can be stored on a shared filesystem so that sysadmins can have a single file to modify to control configuration for multiple machines. Also GDM distributions may patch this file on update to improve usability, improve security, etc. Configuration may be customized for a specific machine by editing the `<etc>/gdm/custom.conf` file to include an override for a specific key. Those parameters in the "gui", "greeter" sections, and the security/PamStack key may be customized per-display by specifying them in a file named `<etc>/gdm/custom.conf<display num>`. For example, configuration overrides for display ":103" would be stored in the file `<etc>/gdm/custom.conf:0`. Per-display configuration is supported in GDM 2.14.6 and later.

The `gdmsetup` is a GUI program you can use to edit the GDM configuration. This program may also be launched directly from the login screen if the greeter/ConfigAvailable key is set to "true" Not all keys in the GDM configuration file are supported in the GUI, so you may need to edit the configuration files by hand to edit these keys. If you believe running root-owned GUI's causes security risk, then you would want to always edit the files by hand. This program does not support setting per-display configuration, so per-display configuration files must be set up by hand.

Distributions should edit the `<share>/gdm/defaults.conf` file to establish the default values so these are preserved as defaults and not modified by users modifying their personal configuration file `<etc>/gdm/custom.conf`.

If you want to change configuration by hand, edit the `<etc>/gdm/custom.conf` file and make sure the keyname=value pair you want is included in the appropriate section. For example, to change the "Greeter" key in the "daemon" section, make sure the daemon section of the `<etc>/gdm/custom.conf` file has the value like in this example.

    [daemon]
    Greeter=/usr/lib/gdmgreeter

The configuration files (especially the `<share>/gdm/defaults.conf` and `<etc>/gdm/custom.conf` files) contain useful comments and examples, so read them for more information about changing your configuration. GDM considers lines that start with the "#" character a comment, and these lines will be ignored by GDM. Some keys in the `<share>/gdm/defaults.conf` are commented out while others are set. Commented out values show the default value.

EL archivo `<share>/gdm/defaults.conf` contiene las opciones de configuración predeterminadas para GDM, y no debería ser modificado por el usuario. El archivo `<etc>/gdm/custom.conf` es donde los usuarios pueden especificar sus opciones de configuración personalizadas. Las opciones de configuración especificadas en el archivo `<etc>/gdm/custom.conf` toman precedencia sobre los valores en el archivo principal `<share>/gdm/defaults.conf`. Ejecutar el comando `gdmsetup` hará que el archivo `<etc>/gdm/custom.conf` se modifique con las opciones de configuración del usuario y hará que cualquier programa del IGU de GDM se actualice automáticamente. Anteriormente a la versión 2.13.0.4 GDM sólo soportaba el archivo `<etc>/gdm/gdm.conf`, así que si está usando una versión más antigua de GDM tan sólo edite ese archivo directamente.

La ubicación de los archivos de configuración puede controlarse por medio de las opciones de configuración `--with-defaults-conf` y `--with-custom-conf`. La opción --config del demonio GDM podría usarse también para especificar la ubicación del archivo de configuración. El demonio GDM debe reiniciarse para cambiar el archivo de configuración en uso.

`<share>/gdm/factory-gdm.conf` es el archivo de configuración tal como se empaqueta con el demonio. Esto puede ser útil para ver si el archivo `<share>/gdm/defaults.conf` ha cambiado.

Los demás archivos de configuración de GDM se encuentran, por omisión, en la carpeta `<etc>/gdm/` o sus subdirectorios. Sin embargo, la ubicación de todos los archivos de configuración se definen en los archivos de configuración de GDM, así que el administrador del sistema puede elegir situar estos archivos en cualquier lugar.

Esta es una lista de los contenidos del directorio de configuración:

    locale.alias
    Xsession
    XKeepsCrashing
    modules/
    Init/
    PostLogin/
    PreSession/
    PostSession/

`locale.alias` es un archivo que se parece mucho al archivo de alias regionales del sistema pero no es el mismo. Éstos son los idiomas que están disponibles en su sitema. Todos los idiomas además se prueban para ver si actualmente existen antes de presentárselos al usuario.

`Xsession` es un script que configura una sesión de usuario y después ejecuta la selección de sesión del usuario. Note que el script de sesión se inicia típicamente por el archivo `desktop` asociado con la sesión que el usuario a escogido. Algunas sesiones quizá inicien la sesión del usuario por medio de un mecanismo diferente que el script `Xsession` así que marque el `desktop` apropiado antes de asumir que el problema de inicio está causado por este archivo.

`XKeepsCrashing` es un script que se ejecuta cuando el servidor X continúa colgándose y no se puede recuperar. El script predeterminado incluido funcionará con la mayoría de las distribuciones de Linux y puede ejecutar la aplicación de configuracioón de X siempre que la persona en la consola conozca la contraseña de root.

Los módulos de accesibilidad se configuran en el subdirectorio `modules/`, y son un tema aparte. Lea los archivos predeterminados provistos, tienen documentación adecuada. De nuevo normalmente la instalación predeterminada se da en archivos con `factory` en su nombre, y dichos archivos no se leen, están solo ahí para que usted pueda volver siempre a la configuración predeterminada.

Los archivos que describen las sesiones GDM disponibles siguen la especificación de archivos `.desktop` de freedesktop.org y se instalan en `<etc>/X11/sessions/`. Este directorio también lo lee el gestor de pantallas de KDE para una configuración común. El siguiente directorio `<share>/gdm/BuiltInSessions/` se lee para las sesiones integradas específicas de GDM (KDM las lleva en el propio código cuando se escribió este manual). Por último la configuración predeterminada también lee `<share>/xsessions/` (que debería ser `/usr/share/xsessions/` si realmente quiere cooperar con KDM) donde los paquetes del escritorio pueden instalar sus propios archivos de sesión. Los directorios bajo `<etc>` deberían estar reservados para la configuración. La aproximación de la especificación de archivos de escritorio hace fácil para los sistemas de gestión de paquetes instalar gestores de ventanas y diferentes tipos de sesiones sin requerir que el administrador del sistema edite los archivos. Vea la clave de configuración `SessionDesktopDir` para cambiar las rutas. Solía ocurrir que GDM almacenaba sus sesiones integradas en `<etc>/dm/Sessions/` pero esto es obsoleto a partir de 2.5.90.0 Note que antes de la versión 2.4.4.2 sólo se leía `<etc>/dm/Sessions/`.

Puede desactivarse una sesión (si fue instalada en `<share>xsessions/`) añadiendo un `.desktop` nombrado idénticamente a uno de los directorios anteriores en la ruta (como `<etc>/X11/sessions`) y usando `Hidden=true` en ese archivo.

### Los directorio de scripts

En esta sección explicaremos los directorios `Init`, `PostLogin`, `PreSession` y `PostSession` ya que son muy similares.

Cuando el servidor X se haya iniciado con éxito, GDM intentará ejecutar el script llamado `Init/<displayname>`. Ej: `Init/:0` para la primera pantalla local. Si este archivo no se encuentra, GDM intentará ejecutar `Init/<hostname>`. Ej: `Init/somehost`. Si esto aún no se encuentra, GDM intentará `Init/XDMCP` para todas las entradas XDMCP o `Init/Flexi` para todas las pantallas bajo demanda. Si no se encuentra ninguno de los anteriores, GDM ejecutará `Init/Default`. El script se ejecutará como root y GDM se bloquea hasta que termina. Use el script `Init/*` para las aplicaciones que se suponen que se ejecutan junto con la ventana de entrada de GDM. xconsole por ejemplo. Los comandos para poner el fondo de pantalla, etc. van también en este archivo.

Es responsabilidad del administrador de sistemas decidir si los clientes iniciados por el script Init deben matarse antes de iniciar la sesión del usuario. Esto se controla con la opción de configuración `KillInitClients`

When the user has been successfully authenticated GDM tries the scripts in the `PostLogin` directory in the same manner as for the `Init` directory. This is done before any session setup is done, and so this would be the script where you might setup the home directory if you need to (though you should use the `pam_mount` module if you can for this). You have the `$USER` and `$DISPLAY` environment variables set for this script, and again it is run as root. The script should return 0 on success as otherwise the user won't be logged in. This is not true for failsafe session however.

After the user session has been setup from the GDM side of things, GDM will run the scripts in the `PreSession` directory, again in the same manner as the `Init` directory. Use this script for local session management or accounting stuff. The `$USER` environment variable contains the login of the authenticated user and `$DISPLAY` is set to the current display. The script should return 0 on success. Any other value will cause GDM to terminate the current login process. This is not true for failsafe sessions however. Also `$X_SERVERS` environmental variable is set and this points to a fake generated X servers file for use with the sessreg accounting application.

After this the base `Xsession` script is run with the selected session executable as the first argument. This is run as the user, and really this is the user session. The available session executables are taken from the `Exec=` line in the `.desktop` files in the path specified by `SessionDesktopDir`. Usually this path is `<etc>/X11/sessions/:<etc>/dm/Sessions:/usr/share/xsessions/`. The first found file is used. The user either picks from these sessions or GDM will look inside the file `~/.dmrc` for the stored preference.

This script should really load the users profile and generally do all the voodoo that is needed to launch a session. Since many systems reset the language selections done by GDM, GDM will also set the `$GDM_LANG` variable to the selected language. You can use this to reset the language environmental variables after you run the users profile. If the user elected to use the system language, then `$GDM_LANG` is not set.

When the user terminates his session, the `PostSession` script will be run. Again operation is similar to `Init`, `PostLogin` and `PreSession`. Again the script will be run with root privileges, the slave daemon will block and the `$USER` environment variable will contain the name of the user who just logged out and `$DISPLAY` will be set to the display the user used, however note that the X server for this display may already be dead and so you shouldn't try to access it. Also `$X_SERVERS` environmental variable is set and this points to a fake generated X servers file for use with the sessreg accounting application.

Note that the `PostSession` script will be run even when the display fails to respond due to an I/O error or similar. Thus, there is no guarantee that X applications will work during script execution.

Except for the `Xsession` script all of these scripts will also have the environment variable `$RUNNING_UNDER_GDM` set to `yes`, so that you could perhaps use similar scripts for different display managers. The `Xsession` will always have the `$GDMSESSION` set to the basename of the session that the user chose to run without the `.desktop` extension. In addition `$DESKTOP_SESSION` is also set to the same value and in fact this will also be set by KDM in future versions.

Neither of the `Init`, `PostLogin`, `PreSession` or `PostSession` scripts are necessary and can be left out. The `Xsession` script is however required as well as at least one session `.desktop` file.

### Los archivos de configuración - `defaults.conf` y `custom.conf`

GDM usa dos archivos de configuración: `<share>/gdm/defaults.conf` y `<etc>/gdm/custom.conf`. El archivo `<share>/gdm/defaults.conf` contiene las elecciones de configuración predeterminadas para GDM, y no debería modificarse por el usuario. El archivo `<etc>/gdm/custom.conf` es donde los usuarios pueden especificar sus elecciones de configuración personales. Las opciones de configuración especificadas en el archivo `<etc>/gdm/custom.conf` toman precedencia sobre los valores en el archivo `<share>/gdm/defaults.conf` Si una opción de configuración no está definida en cualquier archivo, GDM usará el valor predeterminado descrito en los comentarios en el archivo `<share>/gdm/defaults.conf`.

Running the `gdmsetup` command will cause the `<etc>/gdm/custom.conf` to be modified with the user's configuration choices.

Previous to GDM 2.13.0.4 only the `<etc>/gdm/gdm.conf` existed. If upgrading to the new version of GDM, install will check to see if your `<etc>/gdm/gdm.conf` file is different than your `<etc>/gdm/factory-gdm.conf` file. If so, your `<etc>/gdm/gdm.conf` file will be automatically copied to `<etc>/gdm/custom.conf` to preserve any configuration changes.

The location of the configuration files may be controlled via the `--with-defaults-conf` and `--with-custom-conf` configuration options. The GDM daemon --config option may instead be used to specify the configuration file location. The GDM daemon must be restarted to change the configuration file being used.

Both configuration files are divided into sections each containing variables that define the behavior for a specific part of the GDM suite. Refer to the comments in the `<share>/gdm/defaults.conf` file for additional information about each configuration setting.

The `<share>/gdm/defaults.conf` and `<etc>/gdm/custom.conf` files follow the standard `.ini` style configuration file syntax. Keywords in brackets define sections, strings before an equal sign (=) are variables and the data after equal sign represents their value. Empty lines or lines starting with the hash mark (#) are ignored. The graphical configurator will try to preserve both comments (lines with a hash mark) and the overall structure of the file so you can intermix using the GUI or hand editing the configuration file.

#### Configuración del demonio

##### [daemon]

AddGtkModules

      AddGtkModules=false

  Si es true, entonces activa `gdmgreeter` o `gdmlogin` para que se lancen con módulos GTK+ adicionales. esto es útil cuando se requieren características extra como un inicio sesión accesible. Note que sólo deberían usarse los módulos «confiables» para minimizar las cuestiones de seguridad.

  Usualmente esto se usa para los módulos de accesibilidad. Los módulos que se cargan se especifican con la clave `GtkModulesList`.

AlwaysRestartServer

      AlwaysRestartServer=false

  If true, then gdm never tries to reuse existing X servers by reinitializing them. It will just kill the existing X server and start over. Normally, just reinitializing is a nicer way to go but if the X server memory usage keeps growing this may be a safer option. On Solaris, this value is always true, and this configuration setting is ignored.

AlwaysLoginCurrentSession

      AlwaysLoginCurrentSession=true

  If true, then when the user logs in and already has an existing session, then they are connected to that session rather than starting a new session. This only works for session's running on VT's (Virtual Terminals) started with gdmflexiserver, and not with XDMCP. Note that VT's are not supported on all operating systems.

AutomaticLoginEnable

      AutomaticLoginEnable=false

  If the user given in AutomaticLogin should be logged in upon first bootup. No password will be asked. This is useful for single user workstations where local console security is not an issue. Also could be useful for public terminals, although there see `TimedLogin`.

AutomaticLogin

      AutomaticLogin=

  This user should be automatically logged in on first bootup. AutomaticLoginEnable must be true and this must be a valid user for this to happen. "root" can never be autologged in however and gdm will just refuse to do it even if you set it up.

  The following control chars are recognized within the specified name:

  &percnt;&percnt;— the `&percnt;' character

  &percnt;d — display's name

  &percnt;h — display's hostname

  Alternatively, the name may end with a vertical bar |, the pipe symbol. The name is then used as a application to execute which returns the desired username on standard output. If an empty or otherwise invalid username is returned, automatic login is not performed. This feature is typically used when several remote displays are used as internet kiosks, with a specific user to automatically login for each display.

BaseXsession

      BaseXsession=<etc>/gdm/Xsession

  This is the base X session file. When a user logs in, this script will be run with the selected session as the first argument. The selected session will be the `Exec=` from the `.desktop` file of the session.

  If you wish to use the same script for several different display managers, and wish to have some of the script run only for GDM, then you can check the presence of the `GDMSESSION` environmental variable. This will always be set to the basename of `.desktop` (without the extension) file that is being used for this session, and will only be set for GDM sessions. Previously some scripts were checking for `GDM_LANG`, but that is only set when the user picks a non-system default language.

  This script should take care of doing the "login" for the user and so it should source the `<etc>/profile` and friends. The standard script shipped with GDM sources the files in this order: `<etc>/profile` then `~/.profile` then `<etc>/xprofile` and finally `~/.xprofile`. Note that different distributions may change this however. Sometimes users personal setup will be in `~/.bash_profile`, however broken that is.

Chooser

      Chooser=<bin>/gdmchooser

  Ruta completa y nombre del ejecutable del selector seguido de argumentos opcionales.

Configurator

      Configurator=<bin>/gdmsetup --disable-sound --disable-crash-dialog

  The pathname to the configurator binary. If the greeter `ConfigAvailable` option is set to true then run this binary when somebody chooses Configuration from the Actions menu. Of course GDM will first ask for root password however. And it will never allow this to happen from a remote display.

ConsoleCannotHandle

      ConsoleCannotHandle=am,ar,az,bn,el,fa,gu,hi,ja,ko,ml,mr,pa,ta,zh

  These are the languages that the console cannot handle because of font issues. Here we mean the text console, not X. This is only used when there are errors to report and we cannot start X.

ConsoleNotify

      ConsoleNotify=true

  If false, gdm will not display a message dialog on the console when an error happens.

DefaultPath

      DefaultPath=defaultpath (value set by configure)

  Specifies the path which will be set in the user's session. This value will be overridden with the value from `/etc/default/login` if it contains "ROOT=<pathname>". If the `/etc/default/login` file exists, but contains no value for ROOT, the value as defined in the GDM configuration will be be used.

DefaultSession

      DefaultSession=gnome.desktop

  The session that is used by default if the user does not have a saved preference and has picked 'Last' from the list of sessions. Note that 'Last' need not be displayed, see the `ShowLastSession` key.

DisplayInitDir

      DisplayInitDir=<etc>/gdm/Init

  Directory containing the display init scripts. See the ``The Script Directories'' section for more info.

DisplayLastLogin

      DisplayLastLogin=true

  If true then the last login information is printed to the user before being prompted for password. While this gives away some info on what users are on a system, it on the other hand should give the user an idea of when they logged in and if it doesn't seem kosher to them, they can just abort the login and contact the sysadmin (avoids running malicious startup scripts). This was added in version 2.5.90.0.

  This is for making GDM conformant to CSC-STD-002-85, although that is purely theoretical now. Someone should read that spec and ensure that this actually conforms (in addition to other places in GDM). See `http://www.radium.ncsc.mil/tpep/library/rainbow/CSC-STD-002-85.html` for more info.

DoubleLoginWarning

      DoubleLoginWarning=true

  If true, GDM will warn the user if they are already logged in on another virtual terminal. On systems where GDM supports checking the X virtual terminals, GDM will let the user switch to the previous login virtual terminal instead of logging in.

DynamicXServers

      DynamicXServers=false

  If true, the GDM daemon will honor requests to manage displays via the `/tmp/.gdm_socket` socket connection. Displays can be created, started, and deleted with the appropriate commands. The `gdmdynamic` command is a convenient method to send these messages.

FailsafeXServer

      FailsafeXServer=

  An X command line in case we can't start the normal X server. should probably be some sort of a script that runs an appropriate low resolution X server that will just work. This is tried before the `XKeepsCrashing` script is run.

FirstVT

      FirstVT=7

  On systems where GDM supports automatic VT (virtual terminal) allocation, this is the first vt to try. Usually standard text logins are run on the lower vts. See also `VTAllocation`.

FlexibleXServers

      FlexibleXServers=5

  The maximum number of allowed flexible displays. These are displays that can be run using the `/tmp/.gdm_socket` socket connection. This is used for both full flexible displays and for Xnest displays.

FlexiReapDelayMinutes

      FlexiReapDelayMinutes=5

  After how many minutes of inactivity at the login screen should a flexi display be reaped. This is only in effect before a user logs in. Also it does not affect the Xnest flexiservers. To turn off this behavior set this value to 0. This was added in version 2.5.90.0.

Greeter

      Greeter=<bin>/gdmlogin

  Full path and name of the greeter executable followed by optional arguments. This is the greeter used for all displays except for the XDMCP remote displays. See also `RemoteGreeter`

Group

      Group=gdm

  The group name under which `gdmlogin`, `gdmgreeter`, `gdmchooser` and the internal failsafe GTK+ dialogs are run. Also see `User`. This user will have access to all the X authorization files, and perhaps to other internal GDM data and it should not therefore be a user such as nobody, but rather a dedicated user. The `ServAuthDir` is owned by this group. The ownership and permissions of `ServAuthDir` should be `root.gdm` and 1770.

GtkModulesList

      GtkModulesList=module-1:module-2:...

  A colon separated list of Gtk+ modules that `gdmgreeter` or `gdmlogin` will be invoked with if `AddGtkModules` is true. The format is the same as the standard Gtk+ module interface.

HaltCommand

      HaltCommand=<sbin>/shutdown -h now

  Full path and arguments to command to be executed when user selects "Shut Down" from the Actions menu. This can be a ';' separated list of commands to try. If a value is missing, the shut down command is not available. Note that the default for this value is not empty, so to disable "Shut Down" it must be set to an empty value.

KillInitClients

      KillInitClients=true

  Determines whether GDM should kill X clients started by the init scripts when the user logs in.

Directorio de registro

      LogDir=<var>/log/gdm

  Directory containing the log files for the individual displays. By default this is the same as the ServAuthDir.

PidFile

      PidFile=<var>/run/gdm.pid

  Name of the file containing the `gdm` process id.

PreFetchProgram

      PreFetchProgram=command

  Program to be run by the GDM greeter/login program when the initial screen is displayed. The purpose is to provide a hook where files which will be used after login can be preloaded to speed performance for the user. The program will be called once only, the first time a greeter is displayed. The gdmprefetch command may be used. This utility will load any libraries passed in on the command line, or if the argument starts with a "@" character, it will process the file assuming it is an ASCII file containing a list of libraries, one per line, and load each library in the file.

PostLoginScriptDir

      PostLoginScriptDir=<etc>/gdm/PostLogin

  Directory containing the scripts run right after the user logs in, but before any session setup is done. See the ``The Script Directories'' section for more info.

PostSessionScriptDir

      PostSessionScriptDir=<etc>/gdm/PostSession

  Directory containing the scripts run after the user logs out. See the ``The Script Directories'' section for more info.

PreSessionScriptDir

      PreSessionScriptDir=<etc>/gdm/PreSession

  Directory containing the scripts run before the user logs in. See the ``The Script Directories'' section for more info.

RebootCommand

      RebootCommand=<sbin>/shutdown -r now

  Full path and optional arguments to the command to be executed when user selects Restart from the Actions menu. This can be a ';' separated list of commands to try. If missing, the restart command is not available. Note that the default for this value is not empty so to disable restart you must set this explicitly to an empty value.

RemoteGreeter

      RemoteGreeter=<bin>/gdmlogin

  Full path and name of the greeter executable followed by optional arguments. This is used for all remote XDMCP sessions. It is useful to have the less graphically demanding greeter here if you use the Themed Greeter for your main greeter. See also the `Greeter` key.

RootPath

      RootPath=defaultpath (value set by configure)

  Specifies the path which will be set in the root's session and the {Init,PostLogin,PreSession,PostSession} scripts executed by GDM. This value will be overridden with the value from `/etc/default/login` if it contains "SUROOT=<pathname>". If the `/etc/default/login` file exists, but contains no value for SUROOT, the value as defined in the GDM configuration will be used.

ServAuthDir

      ServAuthDir=<var>/gdm

  Directory containing the X authentication files for the individual displays. Should be owned by `root.gdm` with permissions 1770, where `gdm` is the GDM group as defined by the `Group` option. That is should be owned by root, with `gdm` group having full write permissions and the directory should be sticky and others should have no permission to the directory. This way the GDM user can't remove files owned by root in that directory, while still being able to write its own files there. GDM will attempt to change permissions for you when it's first run if the permissions are not the above. This directory is also used for other private files that the daemon needs to store. Other users should not have any way to get into this directory and read/change it's contents. Anybody who can read this directory can connect to any display on this computer.

SessionDesktopDir

      SessionDesktopDir=<etc>/X11/sessions/:<etc>/dm/Sessions/:<share>/xsessions/

  Directory containing the `.desktop` files which are the available sessions on the system. Since 2.4.4.2 this is treated like a PATH type variable and the first file found is used.

SoundProgram

      SoundProgram=<bin>/play (or <bin>/audioplay on Solaris)

  Application to use when playing a sound. Currently used for playing the login sound, see the `SoundOnLoginFile` key. Supported since 2.5.90.0.

StandardXServer

      StandardXServer=/dir/to/X (value assigned by configuration file)

  Full path and arguments to the standard X server command. This is used when gdm cannot find any other definition, and it's used as the default and failsafe fallback in a number of places. This should be able to run some sort of X server.

SuspendCommand

      SuspendCommand=

  Full path and arguments to command to be executed when user selects Suspend from the Actions menu. If empty there is no such menu item. Note that the default for this value is not empty so to disable suspend you must set this explicitly to an empty value.

TimedLoginEnable

      TimedLoginEnable=false

  If the user given in `TimedLogin` should be logged in after a number of seconds (set with `TimedLoginDelay`) of inactivity on the login screen. This is useful for public access terminals or perhaps even home use. If the user uses the keyboard or browses the menus, the timeout will be reset to `TimedLoginDelay` or 30 seconds, whichever is higher. If the user does not enter a username but just hits the ENTER key while the login program is requesting the username, then GDM will assume the user wants to login immediately as the timed user. Note that no password will be asked for this user so you should be careful, although if using PAM it can be configured to require password entry before allowing login.

TimedLogin

      TimedLogin=

  This is the user that should be logged in after a specified number of seconds of inactivity. This can never be "root" and gdm will refuse to log in root this way. The same features as for `AutomaticLogin` are supported. The same control chars and piping to a application are supported.

TimedLoginDelay

      TimedLoginDelay=30

  Delay in seconds before the `TimedLogin` user will be logged in. It must be greater then or equal to 10.

User

      User=gdm

  The username under which `gdmlogin`, `gdmgreeter`, `gdmchooser` and the internal failsafe GTK+ dialogs are run. Also see `Group`. This user will have access to all the X authorization files, and perhaps to other internal GDM data and it should not therefore be a user such as nobody, but rather a dedicated user.

UserAuthDir

      UserAuthDir=

  The directory where user's `.Xauthority` file should be saved. When nothing is specified the user's home directory is used. This is tilde expanded so you can set it to things like: `~/authdir/`.

  If you do not use the tilde expansion, then the filename created will be random, like in `UserAuthFBDir`. This way many users can have the same authentication directory. For example you might want to set this to `/tmp` when user has the home directory on NFS, since you really don't want cookie files to go over the wire. The users should really have write privileges to this directory, and this directory should really be sticky and all that, just like the `/tmp` directory.

  Normally if this is the users home directory GDM will still refuse to put cookies there if it thinks it is NFS (by testing root-squashing). This can be changed by setting `NeverPlaceCookiesOnNFS` in the `[security]` section to false.

UserAuthFBDir

      UserAuthFBDir=/tmp

  If GDM fails to update the user's `.Xauthority` file a fallback cookie is created in this directory.

UserAuthFile

      UserAuthFile=.Xauthority

  Name of the file used for storing user cookies.

VTAllocation

      VTAllocation=true

  On systems where GDM supports automatic VT (virtual terminal) allocation (currently Linux and FreeBSD only), you can have GDM automatically append the vt argument to the X server executable. This way races that come up from each X server managing it's own vt allocation can be avoided. See also `FirstVT`.

XKeepsCrashing

      XKeepsCrashing=<etc>/gdm/XKeepsCrashing

  A script to run in case X keeps crashing. This is for running An X configuration or whatever else to make the X configuration work. See the script that came with the distribution for an example. The distributed `XKeepsCrashing` script is tested on Red Hat, but may work elsewhere. Your system integrator should make sure this script is up to date for your particular system.

  In case `FailsafeXServer` is setup, that will be tried first. and this only used as a backup if even that X server keeps crashing.

Xnest

      Xnest=<bin>/X11/Xnest (/usr/openwin/bin/Xnest on Solaris)

  The full path and arguments to the Xnest command. This is used for the flexible Xnest displays. This way the user can start new login screens in a nested window. Of course you must have the Xnest display from your X server packages installed for this to work.

#### Opciones de seguridad

##### [security]

AllowRoot

      AllowRoot=true

  Allow root (privileged user) to log in through GDM. Set this to false if you want to disallow such logins.

  On systems that support PAM, this parameter is not as useful as you can use PAM to do the same thing, and in fact do even more. However it is still followed, so you should probably leave it true for PAM systems.

AllowRemoteRoot

      AllowRemoteRoot=false

  Allow root (privileged user) to log in remotely through GDM. This value should be set to true to allow such logins. Remote logins are any logins that come in through the XDMCP.

  On systems that support PAM, this parameter is not as useful since you can use PAM to do the same thing, and do even more.

  This value will be overridden and set to false if the `/etc/default/login` file exists and contains "CONSOLE=/dev/login", and set to true if the `/etc/default/login` file exists and contains any other value or no value for CONSOLE.

AllowRemoteAutoLogin

      AllowRemoteAutoLogin=false

  Allow the timed login to work remotely. That is, remote connections through XDMCP will be allowed to log into the "TimedLogin" user by letting the login window time out, just like the local user on the first console.

  Note that this can make a system quite insecure, and thus is off by default.

CheckDirOwner

      CheckDirOwner=true

  By default GDM checks the ownership of the home directories before writing to them, this prevents security issues in case of bad setup. However in some instances home directories will be owned by a different user and in this case it is necessary to turn this option on. You will also most likely have to turn the `RelaxPermissions` key to at least value 1 since in such a scenario home directories are likely to be group writable. Supported since 2.6.0.4.

DisallowTCP

      DisallowTCP=true

  If true, then always append `-nolisten tcp` to the command line of local X servers, thus disallowing TCP connection. This is useful if you do not care for allowing remote connections, since the X protocol could really be potentially a security hazard to leave open, even though no known security problems exist.

NeverPlaceCookiesOnNFS

      NeverPlaceCookiesOnNFS=true

  Normally if this is true (which is by default), GDM will not place cookies into the users home directory if this directory is on NFS. Well, GDM will consider any filesystem with root-squashing an NFS filesystem. Sometimes however the remote file system can have root squashing and be safe (perhaps by using encryption). In this case set this to 'false'. Note that this option appeared in version 2.4.4.4 and is ignored in previous versions.

PasswordRequired

      PasswordRequired=false

  If true, this will cause PAM_DISALLOW_NULL_AUTHTOK to be passed as a flag to pam_authenticate and pam_acct_mgmt, disallowing NULL password. This setting will only take effect if PAM is being used by GDM. This value will be overridden with the value from `/etc/default/login` if it contains "PASSREQ=[YES|NO]". If the `/etc/default/login` file exists, but contains no value for PASSREQ, the value as defined in the GDM configuration will be used.

RelaxPermissions

      RelaxPermissions=0

  By default GDM ignores files and directories writable to other users than the owner.

  Changing the value of RelaxPermissions makes it possible to alter this behavior:

  0 - Paranoia option. Only accepts user owned files and directories.

  1 - Allow group writable files and directories.

  2 - Allow world writable files and directories.

RetryDelay

      RetryDelay=1

  The number of seconds GDM should wait before reactivating the entry field after a failed login.

UserMaxFile

      UserMaxFile=65536

  GDM will refuse to read/write files bigger than this number (specified in bytes).

  In addition to the size check GDM is extremely picky about accessing files in user directories. It will not follow symlinks and can optionally refuse to read files and directories writable by other than the owner. See the `RelaxPermissions` option for more info.

#### XDCMP Support

##### [xdmcp]

DisplaysPerHost

      DisplaysPerHost=1

  To prevent attackers from filling up the pending queue, GDM will only allow one connection for each remote computer. If you want to provide display services to computers with more than one screen, you should increase the `DisplaysPerHost` value accordingly.

  Note that the number of connections from the local computer is unlimited. Only remote connections are limited by this number.

Enable

      Enable=false

  Setting this to true enables XDMCP support allowing remote displays/X terminals to be managed by GDM.

  `gdm` listens for requests on UDP port 177. See the Port option for more information.

  If GDM is compiled to support it, access from remote displays can be controlled using the TCP Wrappers library. The service name is `gdm`

  You should add

      gdm:.my.domain

  to your `<etc>/hosts.allow`, depending on your TCP Wrappers configuration. See the hosts.allow(5) man page for details.

  Note que XDMCP no es un protocolo particularmente seguro y que es una buena idea bloquear el puerto UDP 177 en su cortafuegos a no ser que realmente lo necesite.

EnableProxy

      EnableProxy=false

  Setting this to true enables support for running XDMCP sessions on a local proxy X server. This may improve the performance of XDMCP sessions, especially on high latency networks, as many X protocol operations can be completed without going over the network.

  Note, however, that this mode will significantly increase the burden on the machine hosting the XDMCP sessions

  See the `FlexiProxy` and `FlexiProxyDisconnect` options for further details on how to configure support for this feature.

HonorIndirect

      HonorIndirect=true

  Enables XDMCP INDIRECT choosing (i.e. remote execution of `gdmchooser`) for X-terminals which don't supply their own display browser.

MaxPending

      MaxPending=4

  To avoid denial of service attacks, GDM has fixed size queue of pending connections. Only MaxPending displays can start at the same time.

  Please note that this parameter does *not* limit the number of remote displays which can be managed. It only limits the number of displays initiating a connection simultaneously.

MaxPendingIndirect

      MaxPendingIndirect=4

  GDM will only provide `MaxPendingIndirect` displays with host choosers simultaneously. If more queries from different hosts come in, the oldest ones will be forgotten.

MaxSessions

      MaxSessions=16

  Determines the maximum number of remote display connections which will be managed simultaneously. I.e. the total number of remote displays that can use your host.

MaxWait

      MaxWait=30

  When GDM is ready to manage a display an ACCEPT packet is sent to it containing a unique session id which will be used in future XDMCP conversations.

  GDM will then place the session id in the pending queue waiting for the display to respond with a MANAGE request.

  If no response is received within MaxWait seconds, GDM will declare the display dead and erase it from the pending queue freeing up the slot for other displays.

MaxWaitIndirect

      MaxWaitIndirect=30

  The MaxWaitIndirect parameter determines the maximum number of seconds between the time where a user chooses a host and the subsequent indirect query where the user is connected to the host. When the timeout is exceeded, the information about the chosen host is forgotten and the indirect slot freed up for other displays. The information may be forgotten earlier if there are more hosts trying to send indirect queries then `MaxPendingIndirect`.

Port

      Port=177

  The UDP port number `gdm` should listen to for XDMCP requests. Don't change this unless you know what you are doing.

PingIntervalSeconds

      PingIntervalSeconds=15

  Interval in which to ping the X server in seconds. If the X server doesn't return before the next time we ping it, the connection is stopped and the session ended. This is a combination of the XDM PingInterval and PingTimeout, but in seconds.

  Note that GDM in the past used to have a `PingInterval` configuration key which was also in minutes. For most purposes you'd want this setting to be lower then one minute however since in most cases where XDMCP would be used (such as terminal labs), a lag of more than 15 or so seconds would really mean that the terminal was turned off or restarted and you would want to end the session.

ProxyReconnect

      FlexiProxyReconnect=

  Setting this option enables experimental support for session migration with XDMCP sessions. This enables users to disconnect from their session and later reconnect to that same session, possibly from a different terminal.

  In order to use this feature, you must have a nested X server available which supports disconnecting from its parent X server and reconnecting to another X server. Currently, the Distributed Multihead X (DMX) server supports this feature to some extent and other projects like NoMachine NX are busy implementing it.

  This option should be set to the path of a command which will handle reconnecting the XDMCP proxy to another backend display. A sample implementation for use with DMX is supplied.

ProxyXServer

      ProxyXServer=

  The X server command line for a XDMCP proxy. Any nested X server like Xnest, Xephr or Xdmx should work fairly well.

Willing

      Willing=<etc>/gdm/Xwilling

  When the machine sends a WILLING packet back after a QUERY it sends a string that gives the current status of this server. The default message is the system ID, but it is possible to create a script that displays customized message. If this script doesn't exist or this key is empty the default message is sent. If this script succeeds and produces some output, the first line of it's output is sent (and only the first line). It runs at most once every 3 seconds to prevent possible denial of service by flooding the machine with QUERY packets.

#### Opciones comunes de configuración a través del IGU

##### [gui]

AllowGtkThemeChange

      AllowGtkThemeChange=true

  If to allow changing the GTK+ (widget) theme from the greeter. Currently this only affects the standard greeter as the graphical greeter does not yet have this ability. The theme will stay in effect on this display until changed and will affect all the other windows that are put up by GDM. Supported since 2.5.90.2.

GtkRC

      GtkRC=

  Path to a `gtkrc` to read when GDM puts up a window. You should really now use the `GtkTheme` key for just setting a theme.

GtkTheme

      GtkTheme=Default

  A name of an installed theme to use by default. It will be used in the greeter, chooser and all other GUI windows put up by GDM. Supported since 2.5.90.2.

GtkThemesToAllow

      GtkThemesToAllow=all

  Comma separated list of themes to allow. These must be the names of the themes installed in the standard locations for GTK+ themes. You can also specify 'all' to allow all installed themes. This is related to the `AllowGtkThemeChange` key. Supported since 2.5.90.2.

MaxIconWidth

      MaxIconWidth=128

  Specifies the maximum icon width (in pixels) that the face browser will display. Icons larger than this will be scaled. This also affects icons in the XDMCP chooser.

MaxIconHeight

      MaxIconHeight=128

  Specifies the maximum icon height (in pixels) that the face browser will display. Icons larger than this will be scaled. This also affects icons in the XDMCP chooser.

#### Configuración del interfaz

##### [greeter]

BackgroundColor

      BackgroundColor=#76848F

  If the BackgroundType is 2, use this color in the background of the greeter. Also use it as the back of transparent images set on the background and if the BackgroundRemoteOnlyColor is set and this is a remote display. This only affects the GTK+ Greeter.

BackgroundProgramInitialDelay

      BackgroundProgramInitialDelay=30

  The background application will be started after at least that many seconds of inactivity.

RestartBackgroundProgram

      RestartBackgroundProgram=true

  If set the background application will be restarted when it has exited, after the delay described below has elapsed. This option can be useful when you wish to run a screen saver application when no user is using the computer.

BackgroundProgramRestartDelay

      BackgroundProgramRestartDelay=30

  The background application will be restarted after at least that many seconds of inactivity.

BackgroundImage

      BackgroundImage=somefile.png

  If the BackgroundType is 1, then display this file as the background in the greeter. This only affects the GTK+ Greeter.

BackgroundProgram

      BackgroundProgram=<bin>/xeyes

  If set this command will be run in the background while the login window is being displayed. Note that not all applications will run this way, since GDM does not usually have a home directory. You could set up home directory for the GDM user if you wish to run applications which require it. This only affects the GTK+ Greeter.

BackgroundRemoteOnlyColor

      BackgroundRemoteOnlyColor=true

  On remote displays only set the color background. This is to make network load lighter. The `BackgroundProgram` is also not run. This only affects the GTK+ Greeter.

BackgroundScaleToFit

      BackgroundScaleToFit=true

  Scale background image to fit the screen. This only affects the GTK+ Greeter.

BackgroundType

      BackgroundType=2

  The type of background to set. 0 is none, 1 is image and color, 2 is color and 3 is image. This only affects the GTK+ Greeter.

Browser

      Browser=true

  Set to true to enable the face browser. See the ``The GTK+ Greeter'' section for more information on the face browser. This option only works for the GTK+ Greeter. For the Themed Greeter, the face browser is enabled by choosing a theme which includes a face browser

ChooserButton

      ChooserButton=true

  If true, add a chooser button to the Actions menu that will restart the current X server with a chooser. XDMCP does not need to be enabled on the local computer for this to work.

ConfigAvailable

      ConfigAvailable=false

  If true, allows the configurator to be run from the greeter. Note that the user will need to type in the root password before the configurator will be started. This is set to false by default for additional security. See the `Configurator` option in the daemon section.

DefaultFace

      DefaultFace=<share>/pixmaps/nophoto.png

  Si un usuario no tiene una imagen de rostro definida, GDM usará el icono "stock_person" definido en el tema GTK+ actual. Si dicha imagen no está definida, entonces usará la imagen especificada en la opción de configuración `DefaultFace`. La imagen debe estar en un formato soportado por gdk-pixbuf y el archivo debe poderlo leer el usuario de GDM.

Include

      Include=

  Lista separada por comas de usuarios que serán incluidos en el visor de rostros y en la lista de selección de `gdmsetup` para el inicio de sesión automático/temporizado. Vea además `Exclude`, `IncludeAll`, y `MinimalUID`.

Exclude

      Exclude=bin,daemon,adm,lp,sync,shutdown,halt,mail,...

  Lista separada por comas de usuarios que serán excluidos en el visor de rostros y en la lista de selección de `gdmsetup` para el inicio de sesión automático/temporizado. Vea además `Exclude`, `IncludeAll`, y `MinimalUID`.

IncludeAll

      IncludeAll=false

  Por omisión, una lista de inclusión vacía significa no mostrar ningún usuario. Estableciendo IncludeAll al valor «true», se inspeccionará el archivo de contraseñas y todos los usuarios se mostrarán excepto los usuarios excluidos por medio del ajuste de exclusión y los IDs de usuario menores que MinimalUID. Examinar el archivo de contraseñas puede ser lento en sistemas con gran número de usuarios y esta característica no se usará en dichos entornos. Vea además `Include`, `Exclude`, y `MinimalUID`.

GlobalFaceDir

      GlobalFaceDir=<share>/pixmaps/faces/

  Directorio para todo el sistema para los archivos de rostros. El administrador del sistema puede colocar iconos para los usuarios aquí sin tocar los directorios personales. Los rostros se llaman como los nombres de sus usuarios.

  I.e. `<GlobalFaceDir>/johndoe` would contain the face icon for the user ``johndoe''. No image format extension should be specified.

  Las imágenes de los rostros deben almacenarse en un formato soportado por gdk-pixbuf y deben tener permiso de lectura para el usuario GDM.

  A user's own icon file will always take precedence over the sysadmin provided one.

GraphicalTheme

      GraphicalTheme=circles

  The graphical theme that the Themed Greeter should use. it should refer to a directory in the theme directory set by `GraphicalThemeDir`.

Temas gráficos

      GraphicalThemes=circles

  Los temas gráficos que el Interfaz de entrada debería usar si el modo está puesto a Temas aleatorios. Esto es una lista delimitada por "/:" . Debería referirse a un directorio en el directorio del tema designado por `GraphicalThemeDir`. Esto se usa sólo si `GraphicalThemeRand` está establecido a «true».

GraphicalThemeRand

      GraphicalThemeRand=false

  Whether the graphical greeter will use Only One Theme or Random Theme mode. Only One Theme mode uses themes listed by `GraphicalTheme`, Random Themes mode uses themes listed by `GraphicalThemes`. A value of false sets greeter to use Only One Theme mode, a value of true sets the greeter to use Random Theme mode.

GraphicalThemeDir

      GraphicalThemeDir=<share>/gdm/themes/

  The directory where themes for the Themed Greeter are installed.

GraphicalThemedColor

      GraphicalThemedColor=#76848F

  Use this color in the background of the Themed Greeter. This only affects the Themed Greeter.

InfoMsgFile

      InfoMsgFile=/path/to/infofile

  If present and /path/to/infofile specifies an existing and readable text file (e.g. <etc>/infomsg.txt) the contents of the file will be displayed in a modal dialog box before the user is allowed to login. This works both with the standard and the themable greeters.

InfoMsgFont

      InfoMsgFont=fontspec

  If present and InfoMsgFile (see above) is used, this specifies the font to use when displaying the contents of the InfoMsgFile text file. For example fontspec could be Sans 24 to get a sans serif font of size 24 points. This works both with the standard and the themable greeters.

LocaleFile

      LocaleFile=<etc>/gdm/locale.alias

  File in format similar to the GNU locale format with entries for all supported languages on the system. The format is described above or in a comment inside that file.

LockPosition

      LockPosition=true

  If true the position of the login window of the GTK+ Greeter cannot be changed even if the title bar is turned on.

Logo

      Logo=<share>/pixmaps/gnome-logo-large.png

  Image file to display in the logo box. The file must be in an gdk-pixbuf supported format and it must be readable by the GDM user. If no file is specified the logo feature is disabled. This only affects the GTK+ Greeter.

ChooserButtonLogo

      ChooserButtonLogo=<share>/pixmaps/gnome-logo-large.png

  Image file to display in the file chooser button in `gdmsetup`. This key is modified by `gdmsetup` and should not be manually modified by the user. This only affects the Login Window Preferences (`gdmsetup`).

MinimalUID

      MinimalUID=100

  The minimal UID that GDM should consider a user. All users with a lower UID will be excluded from the face browser. See also `Include`, `Exclude`, and `IncludeAll`.

PositionX

      PositionX=200

  La posición horizontal de la ventana de entrada del interfaz GTK+.

PositionY

      PositionY=100

  La posición vertical de la ventana de entrada del interfaz GTK+.

Quiver

      Quiver=true

  Controls whether `gdmlogin` should shake the display when an incorrect username/password is entered. This only affects the GTK+ Greeter.

DefaultRemoteWelcome

      DefaultRemoteWelcome=true

  If set to true, the value "Welcome to %n" is used for the `RemoteWelcome`. This value is translated into the appropriate language for the user. If set to false, the `RemoteWelcome` setting is used. This string can use the same special character sequences as explained in the "Text Node" section of the "Themed Greeter" chapter. This explains the meaning of "%n".

RemoteWelcome

      RemoteWelcome=Welcome to &percnt;n

  Controls which text to display next to the logo image in the greeter for remote XDMCP sessions. The same expansion is done here as in the `Welcome` string. This string can use the same special character sequences as explained in the "Text Node" section of the "Themed Greeter" chapter. chapter.

RunBackgroundProgramAlways

      RunBackgroundProgramAlways=false

  If this is true then the background application is run always, otherwise it is only run when the `BackgroundType` is 0 (None) This only affects the GTK+ Greeter.

SetPosition

      SetPosition=true

  If true the position of the login window of the GTK+ Greeter is determined by `PositionX` / `PositionY`.

ShowGnomeFailsafeSession

      ShowGnomeFailsafeSession=true

  Should the greeter show the Gnome Failsafe session in th sessions list.

ShowLastSession

      ShowLastSession=true

  Should the greeter show the 'Last' session in the session list. If this is off, then GDM is in the so called 'switchdesk' mode which for example Red Hat uses. That is, the users can't pick the last session and will just then get the default session (see `DefaultSession`) unless then pick something else for this session only. So if this is off, this really circumvents saving of the last session.

ShowXtermFailsafeSession

      ShowXtermFailsafeSession=true

  Should the greeter show the Xterm Failsafe session in the sessions list.

SoundOnLogin

      SoundOnLogin=true

  If true, the greeter will play a sound or beep when it is ready for a login. See also the `SoundOnLoginFile` key. Supported since 2.5.90.0.

SoundOnLoginSuccess

      SoundOnLoginSuccess=true

  If true, the greeter will play a sound after a successful login attempt. See also the `SoundOnLoginSuccessFile` key.

SoundOnLoginFailure

      SoundOnLoginFailure=true

  If true, the greeter will play a sound after a failed login attempt. See also the `SoundOnLoginFailureFile` key.

SoundOnLoginFile

      SoundOnLoginFile=/path/to/sound.wav

  The file that will be played using the specified sound application (by default that is `/usr/bin/play`) instead of a beep when the greeter is ready for a login. See also the `SoundOnLogin` key and the `SoundProgram` key. Supported since 2.5.90.0.

SoundOnLoginSuccessFile

      SoundOnLoginSuccessFile=/path/to/sound.wav

  The file that will be played using the specified sound application (by default that is `/usr/bin/play`) after a successful login attempt. See also the `SoundOnLoginSuccess` key and the `SoundProgram` key.

SoundOnLoginFailureFile

      SoundOnLoginFailureFile=/path/to/sound.wav

  The file that will be played using the specified sound application (by default that is `/usr/bin/play`) after a failed login attempt. See also the `SoundOnLoginFailure` key and the `SoundProgram` key.

SystemMenu

      SystemMenu=true

  Turns the Actions menu (which used to be called System menu) on or off. If this is off then one of the actions will be available anywhere. These actions include Shutdown, Restart, Configure, XDMCP chooser and such. All of those can however be turned off individually. Shutdown, Restart and Suspend can be turned off by just setting the corresponding keys to empty. Note that the actions menu is only shown on local logins as it would not be safe or even desirable on remote logins, so you don't have to worry about remote users having any sort of console privileges.

  Note that if this is off none of the actions will be available even if a theme for a graphical greeter mistakenly shows them. Also note that sometimes a graphical theme may not show all the available actions as buttons and you may have to press F10 to see the menu.

TitleBar

      TitleBar=true

  Display the title bar in the greeter. This only affects the GTK+ Greeter.

Use24Clock

      Use24Clock=auto

  Select the use of 24 hour clock. Some locales do not support 12 hour format (like Finnish, that is `fi_FI`), and in those locales this setting has no effect at all.

  Possible values are "auto" (default), "true", and "false". If this is set to "auto" or left empty, then time format is chosen from locale settings. Locale settings are based on the language in use, thus it is changed by setting environment variables LANGUAGE (GNU extension), LANG, LC_MESSAGES or LC_ALL in the GDM's runtime environment. Priorities between the mentioned environment variables can be found from your system's C library manual.

UseCirclesInEntry

      UseCirclesInEntry=false

  Use circles instead of asterisks in the password entry. This may not work with all fonts however.

UseInvisibleInEntry

      UseInvisibleInEntry=false

  Do not show any visual feedback is the password entry. This is the standard in console and xdm. Settings this option discards the `UseCirclesInEntry` option.

DefaultWelcome

      DefaultWelcome=true

  Si está establecido a «true» el valor "Welcome" se usa para la `Welcome`. Este valor está traducido en el idioma apropiado para el usuario. Si se establece a «false», se usa el ajuste `Welcome`.

Welcome

      Welcome=Welcome

  Controla qué texto se muestra junto a la imagen del logotipo en el interfaz estándar. Están soportados los siguientes caracteres de control:

  &percnt;&percnt;— the `&percnt;' character

  &percnt;d — display's hostname

  &percnt;h — Fully qualified hostname

  &percnt;m — machine (processor type)

  &percnt;n — Nodename (i.e. hostname without .domain)

  &percnt;r — release (OS version)

  &percnt;s — sysname (i.e. OS)

  Estas cadenas se usan sólo para inicios de sesión locales. Para inicios de sesión remotos XDMCP se usa `RemoteWelcome`.

  In the Themed Greeter the location of this text depends on the theme. Unless the theme uses the stock welcome string somewhere this string will not be displayed at all.

XineramaScreen

      XineramaScreen=0

  If the Xinerama extension is active the login window will be centered on this physical screen (use 0 for the first screen, 1 for the second...).

#### Opciones del selector XDCMP

##### [chooser]

AllowAdd

      AllowAdd=true

  If true, allow the user to add arbitrary hosts to the chooser. This way the user could connect to any host that responds to XDMCP queries from the chooser.

Broadcast

      Broadcast=true

  If true, the chooser will broadcast a query to the local network and collect responses. This way the chooser will always show all available managers on the network. If you need to add some hosts not local to this network, or if you don't want to use a broadcast, you can list them explicitly in the `Hosts` key.

Multicast

      Multicast=true

  If true and IPv6 is enabled, the chooser will send a multicast query to the local network and collect responses from the hosts who have joined multicast group. If you don't want to send a multicast, you can specify IPv6 address in the `Hosts` key. The host will respond if it is listening to XDMCP requests and IPv6 is enabled there.

MulticastAddr

      MulticastAddr=ff02::1

  This is the Link-local Multicast address and is hardcoded here.

DefaultHostImage

      DefaultHostImage=<share>/pixmaps/nohost.png

  File name for the default host icon. This image will be displayed if no icon is specified for a given host. The file must be in an gdk-pixbuf supported format and it must be readable for the GDM user.

HostImageDir

      HostImageDir=<share>/hosts

  Repository for host icon files. The sysadmin can place icons for remote hosts here and they will appear in `gdmchooser`.

  The file name must match the fully qualified name (FQDN) for the host. The icons must be stored in gdk-pixbuf supported formats and they must be readable to the GDM user.

Hosts

      Hosts=host1,host2

  The hosts which should be listed in the chooser. The chooser will only list them if they respond. This is done in addition to broadcast (if `Broadcast` is set), so you need not list hosts on the local network. This is useful if your networking setup doesn't allow all hosts to be reachable by a broadcast packet.

ScanTime

      ScanTime=4

  Specifies how many seconds the chooser should wait for replies to its BROADCAST_QUERY. Really this is only the time in which we expect a reply. We will still add hosts to the list even if they reply after this time.

#### Depurar configuración

##### [debug]

Enable

      Enable=false

  Establecer a verdadero envía la salida de depuración al syslog. Esto puede ser útil para trazar problemas con GDM. Esta salida tiene a ser prolia así que no se debería activar para uso general.

Gestures

      Gestures=false

  Setting to true sends debug ouput concerning the accessibility gesture listeners to the syslog. This can be useful for tracking down problems with them not working properly. This output tends to be verbose so should not be turned on for general use.

#### Definiciones del servidor X

To set up X servers, you need to provide GDM with information about the installed X servers. You can have as many different definitions as you wish, each identified with a unique name. The name `Standard` is required. If you do not specify this server, GDM will assume default values for a 'Standard' server and the path given by `daemon/StandardXServer`. `Standard` is used as the default, in situations when no other server has been defined.

Servers are defined by sections named `server-` followed by the identifier of this server. This should be a simple ASCII string with no spaces. The GUI configuration program allows users to edit the servers defined in the GDM configuration files but currently does not allow adding or deleting entries. Like normal configuration options, `server-` sections in the `<etc>/gdm/custom.conf` file override values in the `<share>/gdm/defaults.conf` file. In other words, if a `server-Standard` section is defined in `<etc>/gdm/custom.conf`, then that will be used and the section in the `<share>/gdm/defaults.conf` file will be ignored.

##### [server-Standard]

nombre

      name=Standard server

  El nombre que se mostrará al usuario.

command

      command=/path/to/X

  El comando a ejecutar, con ruta completa al binario del servidor X, y cualesquier argumentos adicionales necesitados.

flexible

      flexible=true

  Indicates if this server is available as a choice when a user wishes to run a flexible, on demand server.

handled

      handled=true

  Indicates that GDM should run the login window on this server and allow a user to log in. If set to false, then GDM will just run this server and wait for it to terminate. This can be useful to run an X terminal using GDM. When this is done you should normally also add `-terminate` to the command line of the server to make the server terminate after each session. Otherwise the control of the slave will never come back to GDM and, for example, soft restarts won't work. This is because GDM assumes there is a login in progress for the entire time this server is active.

chooser

      chooser=false

  Indicates that GDM should instead of a login window run a chooser on this window and allow the user to choose which server to log into.

#### Configuración de la pantalla X local estática

The static display configuration specifies what displays should be always managed by GDM. GDM will restart the X server on the display if it dies, for example. There may be as many static displays that are managed as you wish, although typically each display is associated with a real display. For example, if a machine has two displays (say display ":0" and display ":1"), then this section can be used to specify that a separate login screen be managed for each screen. Each key in the `[servers]` section corresponds to the display number to be managed. Normally there is only one key, which is the key `0`, which corresponds to the display `:0`.

The GUI configuration program allows users to edit the static display configuration defined in the GDM configuration files and allows the user to add or delete entries. Like normal configuration options, the `[servers]` section in the `<etc>/gdm/custom.conf` file overrides values in the `<share>/gdm/defaults.conf` file.

##### [servers]

<display number>

      0=Standard

  Control section for local displays. Each line indicates the local display number and the command that needs to be run to start the X server(s).

  The command can either be a path to an X executable, or a name of one of the server definitions. This can be followed by some arguments that should be passed to the X server when executed. The gdm daemon doesn't enforce the numbers to be in order or for them to be "packed". They keyword "inactive" can be used instead of a command to specify that the display should be not managed. This can be used in the `<etc>/gdm/custom.conf` to turn off a display that is defined in the `<share>/gdm/defaults.conf` file.

  GDM will splice "`-auth <ServAuthDir>/:n.Xauth :n`", where n is the display number. Inside the command line before all other arguments before running the X server.

  On some systems it is necessary for GDM to know on which virtual consoles to run the X server. In this case, (if running XFree86) add "vt7" to the command line, for example, to run on virtual console 7. However on Linux and FreeBSD this is normally done automatically if the `VTAllocation` key is set.

  Normally you do not need to add a `-nolisten tcp` flag as this is added automatically for local X servers when the `DisallowTCP` option is set.

priority

      priority=0

  Indicates that the X server should be started at a different process priority. Values can be any integer value accepted by the setpriority C library function (normally between -20 and 20) with 0 being the default. For highly interactive applications, -5 yields good responsiveness. The default value is 0 and the setpriority function is not called if the value is 0.

### Configuración por usuario

Hay algunos ajustes de configuración por usuario que controlan cómo se comporta GDM. GDM es bastante estricto con el propietario y los permisos de los archivos de usuario a los que accede, e ignorará los archivos si no pertenecen al usuario o tienen permiso de escritura para el grupo o para todos. Ignorará el usuario si la carpeta personal del usuario ($HOME) no pertenece al usuario o si la carpeta $HOME tiene permiso de escritura para el grupo o para todos. Los archivos deben ser además más pequeños que el valor `UserMaxFile` tal como se define en la configuración de GDM. Si parece que GDM no está accediendo apropiadamente a los ajustes de configuración del usuario, el problema se debe la mayoría de las veces a que una de estas comprobaciones falla.

Primero está el archivo `~/.dmrc`. En teoría este archivo debería ser compartido entre GDM y KDM, así que los usuarios sólo tienen que configurar las cosas una vez. Esto es un archivo de configuración de estilo `.ini` estándar. Tiene una sección llamada `[Desktop]` que tiene dos claves: `Session` y `Language`.

La clave `Session` especifica el nombre base del archivo `.desktop` de sesión que el usuario quiere usar normalmente (sin la extensión `.desktop`, en otras palabras). La clave `Language` especifica el idioma que el usuario quiere usar por omisión. Si cualquiera de estas dos claves falta, se usa el predeterminado del sistema. El archivo normalmente tiene la apariencia siguiente:

    [Desktop]
    Session=gnome
    Language=cs_CZ.UTF-8

Normalmente GDM escribirá este archivo cuando el usuario entre por primera vez, y lo reescribirá si el usuario escoge cambiar su valor predeterminado en una entrada subsiguiente.

If the GDM Face Browser is turned, then the file `$HOME/.face` is accessed. This file should be a standard image that GTK+ can read, such as PNG or JPEG. It also must be smaller than the `MaxIconWidth` and `MaxIconHeight` values defined in the GDM configuration or it will be ignored. Users can run the `gdmphotosetup` program to specify a face image and it will copy the file to the `$HOME/.face` location and scale it so its longest dimension is not larger than the `MaxIconWidth` or `MaxIconHeight` values. `gdmphotosetup` takes care to not change the aspect ratio of the image.

Las imágenes de rostros pueden colocarse en el directorio global de rostros, que se especifica por la opción de configuración `GlobalFaceDir` (normalmente `<share>/pixmaps/faces/`) y el nombre del archivo debería ser el nombre del usuario, opcionalmente con un `.png`, etc. agregado.

## Controlando GDM

Puede controlar el comportamiento de GDM durante la ejecución de varias formas diferentes. Puede o ejecutar ciertos comandos, o puede hablar con GDM usando un protocolo de sockets UNIX, o un protocolo FIFO.

### Comandos

Para parar GDM, puede o bien enviar la señal TERM al demonio principal o ejecutar el comando `gdm-stop` que está en el directorio `/sbin`. Para reiniciar GDM, puede o bien enviar la señal HUP al demonio principal o ejecutar el comando `gdm-restart` que también está en el directorio `/sbin`. Para reiniciar GDM paro sólo después de que todos los usuarios hayan salido de su sesión puede o bien enviar la señal USR1 al demonio principal o ejecutar el comando `gdm-safe-restart` que está en el directorio `/sbin` también.

The `gdmflexiserver` command can be used to start new flexible (on demand) displays if your system supports virtual terminals. This command will normally lock the current session with a screensaver so that the user can safely walk away from the computer and let someone else log in. If more that two flexible displays have started `gdmflexiserver` will display a pop-up dialog allowing the user to select which session to continue. The user will normally have to enter a password to return to the session. On session exit the system will return to the previous virtual terminal. Run `gdmflexiserver --help` to get a listing of possible options.

### El protocolo FIFO

GDM also provides a FIFO called `.gdmfifo` in the `ServAuthDir` directory (usually `<var>/gdm/.gdmfifo`). You must be root to use this protocol, and it is mostly used for internal GDM chatter. It is a very simple protocol where you just echo a command on a single line to this file. It can be used to tell GDM things such as restart, suspend the computer, or restart all X servers next time it has a chance (which would be useful from an X configuration application).

Full and up to date documentation of the commands and their use is contained in the GDM source tree in the file `daemon/gdm.h`. Look for the defines starting with `GDM_SOP_`. The commands which require the pid of the slave as an argument are the ones that are really used for internal communication of the slave with the master and should not be used.

### El protocolo socket

GDM provides a unix domain socket for communication at `/tmp/.gdm_socket`. Using this you can check if GDM is running, the version of the daemon, the current displays that are running and who is logged in on them, and if GDM supports it on your operating system, also the virtual terminals of all the console logins. The `gdmflexiserver` command uses this protocol, for example, to launch flexible (on-demand) displays.

gdmflexiserver accepts the following commands with the --command option:

    ADD_DYNAMIC_DISPLAY
    ALL_SERVERS
    ATTACHED_SERVERS
    AUTH_LOCAL
    CLOSE
    FLEXI_XNEST
    FLEXI_XSERVER
    GET_CONFIG
    GET_CONFIG_FILE
    GET_SERVER_LIST
    GET_SERVER_DETAILS
    GREETERPIDS
    QUERY_LOGOUT_ACTION
    QUERY_VT
    RELEASE_DYNAMIC_DISPLAYS
    REMOVE_DYNAMIC_DISPLAY
    SERVER_BUSY
    SET_LOGOUT_ACTION
    SET_SAFE_LOGOUT_ACTION
    SET_VT
    UPDATE_CONFIG
    VERSION

These are described in detail below, including required arguments, response format, and return codes.

#### ADD_DYNAMIC_DISPLAY

    ADD_DYNAMIC_DISPLAY: Create a new server definition that will
                         run on the specified display leaving, it
                         in DISPLAY_CONFIG state.
    Supported since: 2.8.0.0
    Arguments: <display to run on>=<server>
      Where <server> is either a configuration named in the
      GDM configuration or a literal command name.
    Answers:
      OK <display>
      ERROR <err number> <english error description>
         0 = Not implemented
         2 = Existing display
         3 = No server string
         4 = Display startup failure
         100 = Not authenticated
         200 = Dynamic Displays not allowed
         999 = Unknown error

#### ALL_SERVERS

    ALL_SERVERS: List all displays, including console, remote, xnest.
                 This can, for example, be useful to figure out if
                 the display you are on is managed by the gdm daemon,
                 by seeing if it is in the list.  It is also somewhat
                 like the 'w' command but for graphical sessions.
    Supported since: 2.4.2.96
    Arguments: None
    Answers:
      OK <server>;<server>;...

      <server> is <display>,<logged in user>

      <logged in user> can be empty in case no one logged in yet

      ERROR <err number> <english error description>
         0 = Not implemented
         200 = Too many messages
         999 = Unknown error

#### ATTACHED_SERVERS

    ATTACHED_SERVERS: List all attached displays.  Doesn't list XDMCP
                      and xnest non-attached displays.
    Note:             This command used to be named CONSOLE_SERVERS,
                      which is still recognized for backwards
                      compatibility. The optional pattern argument
                      is supported as of version 2.8.0.0.
    Supported since: 2.2.4.0
    Arguments: <pattern> (optional)
      With no argument, all attached displays are returned. The optional
      <pattern> is a string that may contain glob characters '*', '?', and
      '[]'. Only displays that match the pattern will be returned.
    Answers:
      OK <server>;<server>;...

      <server> is <display>,<logged in user>,<vt or xnest display>

      <logged in user> can be empty in case no one logged
      in yet, and <vt> can be -1 if it's not known or not
      supported (on non-Linux for example).  If the display is an
      xnest display and is a console one (that is, it is an xnest
      inside another console display) it is listed and instead of
      vt, it lists the parent display in standard form.

      ERROR <err number> <english error description>
         1 = Not implemented
         200 = Too many messages
         999 = Unknown error

#### AUTH_LOCAL

    AUTH_LOCAL: Setup this connection as authenticated for
                FLEXI_SERVER.  Because all full blown (non-Xnest)
                displays can be started only from users logged in
                locally, and here GDM assumes only users logged
                in from GDM.  They must pass the xauth
                MIT-MAGIC-COOKIE-1 that they were passed before
                the connection is authenticated.
    Note:       The AUTH LOCAL command requires the
                --authenticate option, although only
                FLEXI XSERVER uses this currently.
    Note:       Since 2.6.0.6 you can also use a global
                <ServAuthDir>/.cookie, which works for all
                authentication except for SET_LOGOUT_ACTION and
                QUERY_LOGOUT_ACTION and SET_SAFE_LOGOUT_ACTION
                which require a logged in display.
    Supported since: 2.2.4.0
    Arguments: <xauth cookie>
      <xauth cookie> is in hex form with no 0x prefix
    Answers:
      OK
      ERROR <err number> <english error description>
         0 = Not implemented
         100 = Not authenticated
         200 = Too many messages
         999 = Unknown error

#### CLOSE

    CLOSE: Close sockets connection
    Supported since: 2.2.4.0
    Arguments: None
    Answers: None

#### FLEXI_XNEST

    FLEXI_XNEXT: Start a new flexible Xnest display.
    Note:        Supported on older version from 2.2.4.0, later
                 2.2.4.2, but since 2.3.90.4 you must supply 4
                 arguments or ERROR 100 will be returned.  This
                 will start Xnest using the XAUTHORITY file
                 supplied and as the uid same as the owner of
                 that file (and same as you supply).  You must
                 also supply the cookie as the third argument
                 for this display, to prove that you indeed are
                 this user.  Also this file must be readable
                 ONLY by this user, that is have a mode of 0600.
                 If this all is not met, ERROR 100 is returned.
    Note:        The cookie should be the MIT-MAGIC-COOKIE-1,
                 the first one GDM can find in the XAUTHORITY
                 file for this display.  If that's not what you
                 use you should generate one first.  The cookie
                 should be in hex form.
    Supported since: 2.3.90.4
    Arguments: <display to run on> <uid of requesting user>
               <xauth cookie for the display> <xauth file>
    Answers:
      OK <display>
      ERROR <err number> <english error description>
         0 = Not implemented
         1 = No more flexi servers
         2 = Startup errors
         3 = X failed
         4 = X too busy
         5 = Xnest can't connect
         6 = No server binary
         100 = Not authenticated
         200 = Too many messages
         999 = Unknown error

#### FLEXI_XSERVER

    FLEXI_XSERVER: Start a new X flexible display.  Only supported on
                   connection that passed AUTH_LOCAL
    Supported since: 2.2.4.0
    Arguments: <xserver type>
      If no arguments, starts the standard X server
    Answers:
      OK <display>
      ERROR <err number> <english error description>
         0 = Not implemented
         1 = No more flexi servers
         2 = Startup errors
         3 = X failed
         4 = X too busy
         6 = No server binary
         100 = Not authenticated
         200 = Too many messages
         999 = Unknown error

#### GET_CONFIG

    GET_CONFIG:  Get configuration value for key.  Useful so
                 that other applications can request configuration
                 information from GDM.  Any key defined as GDM_KEY_*
                 in gdm.h is supported.  Starting with version 2.13.0.2
                 translated keys (such as "greeter/GdmWelcome[cs]" are
                 supported via GET_CONFIG.  Also starting with version
                 2.13.0.2 it is no longer necessary to include the
                 default value (i.e. you can use key "greeter/IncludeAll"
                 instead of having to use "greeter/IncludeAll=false".
    Supported since: 2.6.0.9
    Arguments: <key>
    Answers:
      OK <value>
      ERROR <err number> <english error description>
         0 = Not implemented
         50 = Unsupported key
         200 = Too many messages
         999 = Unknown error

#### GET_CONFIG_FILE

    GET_CONFIG_FILE:  Get config file location being used by
                      the daemon.  If the GDM daemon was started
                      with the --config option, it will return
                      the value passed in via the argument.
    Supported since: 2.8.0.2
    Arguments: None
    Answers:
      OK <full path to GDM configuration file>
      ERROR <err number> <english error description>
         0 = Not implemented
         200 = Too many messages
         999 = Unknown error

#### GET_CUSTOM_CONFIG_FILE

    GET_CUSTOM_CONFIG_FILE:  Get custom config file location being
                            used by the daemon.
    Supported since: 2.14.0.0
    Arguments: None
    Answers:
      OK <full path to GDM custom configuration file>
      ERROR <err number> <english error description>
         0 = Not implemented
         1 = File not found
         200 = Too many messages
         999 = Unknown error

#### GET_SERVER_DETAILS

    GET_SERVER_DETAILS:  Get detail information for a specific server.
    Supported since: 2.13.0.4
    Arguments: <server> <key>
      Key values include:
        NAME      - Returns the server name
        COMMAND   - Returns the server command
        FLEXIBLE  - Returns "true" if flexible, "false"
                    otherwise
        CHOOSABLE - Returns "true" if choosable, "false"
                    otherwise
        HANDLED   - Returns "true" if handled, "false"
                    otherwise
        CHOOSER   - Returns "true" if chooser, "false"
                    otherwise
        PRIORITY  - Returns process priority
    Answers:
      OK <value>
      ERROR <err number> <english error description>
         0 = Not implemented
         1 = Server not found
         2 = Key not valid
         50 = Unsupported key
         200 = Too many messages
         999 = Unknown error

#### GET_SERVER_LIST

    GET_SERVER_LIST:  Get a list of the server sections from
                      the configuration file.
    Supported since: 2.13.0.4
    Arguments: None
    Answers:
      OK <value>;<value>;...
      ERROR <err number> <english error description>
         0 = Not implemented
         1 = No servers found
         50 = Unsupported key
         200 = Too many messages
         999 = Unknown error

#### GREETERPIDS

    GREETERPIDS: List all greeter pids so that one can send HUP
                 to them for config rereading.  Of course one
                 must be root to do that.
    Supported since: 2.3.90.2
    Arguments: None
    Answers:
      OK <pid>;<pid>;...
      ERROR <err number> <english error description>
         0 = Not implemented
         200 = Too many messages
         999 = Unknown error

#### QUERY_LOGOUT_ACTION

    QUERY_LOGOUT_ACTION: Query which logout actions are possible
                         Only supported on connections that passed
                         AUTH_LOCAL.
    Supported since: 2.5.90.0
    Answers:
      OK <action>;<action>;...
         Where action is one of HALT, REBOOT or SUSPEND.  An
         empty list can also be returned if no action is possible.
         A '!' is appended to an action if it was already set with
         SET_LOGOUT_ACTION or SET_SAFE_LOGOUT_ACTION.  Note that
         SET_LOGOUT_ACTION has precedence over
         SET_SAFE_LOGOUT_ACTION.
      ERROR <err number> <english error description>
         0 = Not implemented
         100 = Not authenticated
         200 = Too many messages
         999 = Unknown error

#### QUERY_VT

    QUERY_VT:  Ask the daemon about which VT we are currently on.
               This is useful for logins which don't own
               /dev/console but are still console logins.  Only
               supported on Linux currently, other places will
               just get ERROR 8.  This is also the way to query
               if VT support is available in the daemon in the
               first place.  Only supported on connections that
               passed AUTH_LOCAL.
    Supported since: 2.5.90.0
    Arguments: None
    Answers:
      OK <vt number>
      ERROR <err number> <english error description>
         0 = Not implemented
         8 = Virtual terminals not supported
         100 = Not authenticated
         200 = Too many messages
         999 = Unknown error

#### RELEASE_DYNAMIC_DISPLAYS

    RELEASE_DYNAMIC_DISPLAYS: Release dynamic displays currently in
                              DISPLAY_CONFIG state
    Supported since: 2.8.0.0
    Arguments: <display to release>
    Answers:
      OK <display>
      ERROR <err number> <english error description>
         0 = Not implemented
         1 = Bad display number
         100 = Not authenticated
         200 = Dynamic Displays not allowed
         999 = Unknown error

#### REMOVE_DYNAMIC_DISPLAY

    REMOVE_DYNAMIC_DISPLAY: Remove a dynamic display, killing the server
                            and purging the display configuration
    Supported since: 2.8.0.0
    Arguments: <display to remove>
    Answers:
      OK <display>
      ERROR <err number> <english error description>
         0 = Not implemented
         1 = Bad display number
         100 = Not authenticated
         200 = Dynamic Displays not allowed
         999 = Unknown error

#### SERVER_BUSY

    SERVER_BUSY:  Returns true if half or more of the daemon's sockets
                  are busy, false otherwise.  Used by slave programs
                  which want to ensure they do not overwhelm the
                  sever.
    Supported since: 2.13.0.8
    Arguments: None
    Answers:
      OK <value>
      ERROR <err number> <english error description>
         0 = Not implemented
         200 = Too many messages
         999 = Unknown error

#### SET_LOGOUT_ACTION

    SET_LOGOUT_ACTION: Tell the daemon to halt/restart/suspend after
                       slave process exits.  Only supported on
                       connections that passed AUTH_LOCAL.
    Supported since: 2.5.90.0
    Arguments: <action>
      NONE           Set exit action to 'none'
      HALT           Set exit action to 'halt'
      REBOOT         Set exit action to 'reboot'
      SUSPEND        Set exit action to 'suspend'
    Answers:
      OK
      ERROR <err number> <english error description>
         0 = Not implemented
         7 = Unknown logout action, or not available
         100 = Not authenticated
         200 = Too many messages
         999 = Unknown error

#### SET_SAFE_LOGOUT_ACTION

    SET_SAFE_LOGOUT_ACTION:  Tell the daemon to halt/restart/suspend
                             after everybody logs out.  If only one
                             person logs out, then this is obviously
                             the same as the SET_LOGOUT_ACTION.  Note
                             that SET_LOGOUT_ACTION has precedence
                             over SET_SAFE_LOGOUT_ACTION if it is set
                             to something other then NONE.  If no one
                             is logged in, then the action takes effect
                             effect immediately.  Only supported on
                             connections that passed AUTH_LOCAL.
    Supported since: 2.5.90.0
    Arguments: <action>
      NONE           Set exit action to 'none'
      HALT           Set exit action to 'halt'
      REBOOT         Set exit action to 'reboot'
      SUSPEND        Set exit action to 'suspend'
    Answers:
      OK
      ERROR <err number> <english error description>
         0 = Not implemented
         7 = Unknown logout action, or not available
         100 = Not authenticated
         200 = Too many messages
         999 = Unknown error

#### SET_VT

    SET_VT:  Change to the specified virtual terminal.
             This is useful for logins which don't own /dev/console
             but are still console logins.  Only supported on Linux
             currently, other places will just get ERROR 8.
             Only supported on connections that passed AUTH_LOCAL.
    Supported since: 2.5.90.0
    Arguments: <vt>
    Answers:
      OK
      ERROR <err number> <english error description>
         0 = Not implemented
         8 = Virtual terminals not supported
         9 = Invalid virtual terminal number
         100 = Not authenticated
         200 = Too many messages
         999 = Unknown error

#### UPDATE_CONFIG

    UPDATE_CONFIG: Tell the daemon to re-read a key from the
                   GDM configuration file.   Any user can request
                   that values are re-read but the daemon will
                   only do so if the file has been modified
                   since GDM first read the file.  Only users
                   who can change the GDM configuration file
                   (normally writable only by the root user) can
                   actually modify the GDM configuration.  This
                   command is useful to cause the GDM to update
                   itself to recognize a change made to the GDM
                   configuration file by the root user.

                   Starting with version 2.13.0.0, all GDM keys are
                   supported except for the following:

                          daemon/PidFile
                          daemon/ConsoleNotify
                          daemon/User
                          daemon/Group
                          daemon/LogDir
                          daemon/ServAuthDir
                          daemon/UserAuthDir
                          daemon/UserAuthFile
                          daemon/UserAuthFBDir

                   GDM also supports the following Psuedokeys:

                   xdmcp/PARAMETERS (2.3.90.2) updates the following:
                          xdmcp/MaxPending
                          xdmcp/MaxSessions
                          xdmcp/MaxWait
                          xdmcp/DisplaysPerHost
                          xdmcp/HonorIndirect
                          xdmcp/MaxPendingIndirect
                          xdmcp/MaxWaitIndirect
                          xdmcp/PingIntervalSeconds (only affects new connections)

                    xservers/PARAMETERS (2.13.0.4) updates the following:
                          all [server-foo] sections.

                    Supported keys for previous versions of GDM:

                          security/AllowRoot (2.3.90.2)
                          security/AllowRemoteRoot (2.3.90.2)
                          security/AllowRemoteAutoLogin (2.3.90.2)
                          security/RetryDelay (2.3.90.2)
                          security/DisallowTCP (2.4.2.0)
                          daemon/Greeter (2.3.90.2)
                          daemon/RemoteGreeter (2.3.90.2)
                          xdmcp/Enable (2.3.90.2)
                          xdmcp/Port (2.3.90.2)
                          daemon/TimedLogin (2.3.90.3)
                          daemon/TimedLoginEnable (2.3.90.3)
                          daemon/TimedLoginDelay (2.3.90.3)
                          greeter/SystemMenu (2.3.90.3)
                          greeter/ConfigAvailable (2.3.90.3)
                          greeter/ChooserButton (2.4.2.0)
                          greeter/SoundOnLoginFile (2.5.90.0)
                          daemon/AddGtkModules (2.5.90.0)
                          daemon/GtkModulesList (2.5.90.0)
    Supported since: 2.3.90.2
    Arguments: <key>
      <key> is just the base part of the key such as
      "security/AllowRemoteRoot"
    Answers:
      OK
      ERROR <err number> <english error description>
         0 = Not implemented
         50 = Unsupported key
         200 = Too many messages
         999 = Unknown error

#### VERSION

    VERSION: Query GDM version
    Supported since: 2.2.4.0
    Arguments: None
    Answers:
      GDM <gdm version>
      ERROR <err number> <english error description>
         200 = Too many messages
         999 = Unknown error

## Comandos de GDM

### Comandos de usuario de GDM

The GDM package provides the following different commands in `bindir` intended to be used by the end-user:

#### Opciones de línea de comandos de `gdmXnestchooser` y `gdmXnest`

The `gdmXnestchooser` command automatically gets the correct display number, sets up access, and runs `Xnest` with -indirect localhost. This way you get an XDMCP chooser provided by your computer. You can also supply as an argument the hostname whose chooser should be displayed, so `gdmXnestchooser somehost` will run the XDMCP chooser from host `somehost` inside an Xnest session. You can make this command do a direct query instead by passing the `-d` option as well. In addition to the following options, this command also supports standard GNOME options.

##### `gdmXnestchooser` Command Line Options

-x, --xnest=STRING

  Línea de comandos de Xnest, lo predeterminado es «Xnest»

-o, --xnest-extra-options=OPCIONES

  Opciones extra para Xnest, lo predeterminado es sin opciones.

-n, --no-query

  Tan sólo ejecute Xnest, sin consulta (sin selector)

-d, --direct

  Hace una consulta directa en lugar de indirecta (selector)

-B, --broadcast

  Ejecutar en difusión en vez de indirecto (selector)

-b, --background

  Ejecutar en segundo plano

--no-gdm-check

  No comprueba si hay un GDM funcionando

#### Opciones de línea de comandos de `gdmflexichooser`

The `gdmflexiserver` command provides three features. It can be used to run flexible (on demand) X displays, to run a flexible display via Xnest, and to send commands to the GDM daemon process.

Starting a flexible X display will normally lock the current session with a screensaver and will redisplay the GDM login screen so a second user can log in. This feature is only available on systems that support virtual terminals and have them enabled. This feature is useful if you are logged in as user A, and user B wants to log in quickly but user A does not wish to log out. The X server takes care of the virtual terminal switching so it works transparently. If there is more than one running display defined with flexible=true, then the user is shown a dialog that displays the currently running sessions. The user can then pick which session to continue and will normally have to enter the password to unlock the screen.

Flexible displays started via Xnest works on systems that do not support virtual terminals. This option starts a flexible display in a window in the current session. This does not lock the current session, so is not as secure as a flexible server started via virtual terminals.

The `gdmflexiserver --command` option provides a way to send commands to the GDM daemon and can be used to debug problems or to change the GDM configuration.

In addition to the following options, `gdmflexiserver` also supports standard GNOME options.

##### Opciones de línea de comandos de `gdmflexichooser`

-c, --command=COMMAND

  Enviar el comando de protocolo especificado a GDM

-n, --xnest

  Start a flexible X display in Xnest mode

-l, --no-lock

  No bloquear la pantalla actual

-d, --debug

  Activar salida de depuración para enviarla a syslog. Lo mismo que cuadno se activa la depuración en el archivo de configuración.

-a, --authenticate

  Autenticar antes de ejecutar --command

-s, --startnew

  Inicia un servidor flexible nuevo sin mostrar un diálogo preguntando al usuario si quiere continuar cualquier sesión existente.

#### Opciones de línea de comandos de `gdmdynamic`

The `gdmdynamic` command which creates, runs, and removes displays (X servers) on demand.

Some environments need the ability to tell GDM to create and manage new displays on the fly, where it is not possible to list the possible displays in GDM configuration files. The `gdmdynamic` command can be used to create a new display on a particular display number, run all newly created displays, or remove a display. The `gdmdynamic` command can also be used to list all attached displays, or only attached displays that match a pattern. This program is designed to manage multiple simultaneous requests and works to avoid flooding the daemon with requests. If the socket connection is busy, it will sleep and retry a certain number of times that can be tuned with the `-t` and `-s` arguments. `gdmdynamic` returns 1 on normal failure, and returns 2 if it is unable to connect to the daemon. Callers can choose to call again if a return code of 2 is received.

##### Opciones de línea de comandos de `gdmdynamic`

  One of the following options can be used per instance:

-a display=server

  Add a new display configuration. For example, `"-a 2=StandardServerTwo"``"-a 3=/usr/X11R6/bin/X -dev /dev/fb2"`

-r

  Release (run) all displays waiting in the DISPLAY_CONFIG state.

-d display

  Delete a display, killing the X server and purging the display configuration. For example, "-d 3".

-l [pattern]

  List displays via the ATTACHED_SERVERS command. Without a pattern lists all attached displays. With a pattern will match using glob characters '*', '?', and '[]'. For example: `"-l Standard*"``"-l *Xorg*"`

  These options can be added to the above:

-v

  Verbose mode. Prinr diagnostic messages about each message sent to GDM.

-b

  Background mode. Fork child to do the work and return immediately.

-t RETRY

  If the daemon socket is busy, `gdmdynamic` will retry to open the connection the specified RETRY number of times. Default value is 15.

-s SLEEP

  If the daemon socket is busy, `gdmdynamic` will sleep an amount of time between retries. A random number of seconds 0-5 is added to the SLEEP value to help ensure that multiple calls to gdmdynamic do not all try to restart at the same time. A SLEEP value of zero causes the sleep time to be 1 second. Default value is 8 seconds.

#### Opciones de línea de comandos de `gdmphotosetup`

Allows the user to select an image that will be used as the user's photo by GDM's face browser, if enabled by GDM. The selected file is stored as `~/.face`. This command accepts standard GNOME options.

#### Opciones de línea de comandos de `gdmthemetester`

`gdmthemetester` takes two parameters. The first parameter specifies the environment and the second parameter specifies the path name or the name of a theme to view. This is a tool for viewing a theme outside of GDM. It is useful for testing or viewing themes. `gdmthemetester` requires that the system support `gdmXnest`. Note that themes can display differently depending on the theme's "Show mode". `gdmthemetester` allows viewing the themes in different modes via the environment option. Valid environment values and their meanings follow:

    console       - In console mode.
    console-timed - In console non-flexi mode.
    flexi         - In flexi mode.
    xdmcp         - In remote (XDMCP) mode.
    remote-flexi  - In remote (XDMCP) & flexi mode.

### Comandos del administrador de GDM

The GDM package provides the following different commands in `sbindir` intended to be used by the root user:

#### Opciones de línea de comandos de `gdm` y `gdm-binary`

The `gdm` command is really just a script which runs the `gdm-binary`, passing along any options. Before launching `gdm-binary`, the gdm wrapper script will source the `<etc>/profile` file to set the standard system environment variables. In order to better support internationalization, it will also set the LC_MESSAGES environment variable to LANG if neither LC_MESSAGES or LC_ALL are set. If you really need to set some additional environment before launching GDM, you can do so in this script.

##### Opciones de línea de comandos de `gdm` y `gdm-binary`

--help

  Da un breve resumen de las opciones de línea de comandos.

--nodaemon

  If this option is specified, then GDM does not fork into the background when run. You can also use a single-dash version, "-nodaemon" for compatibility with other display managers.

--no-console

  Tell the daemon that it should not run anything on the console. This means that none of the local servers from the `[servers]` section will be run, and the console will not be used for communicating errors to the user. An empty `[servers]` section automatically implies this option.

--config=CONFIGFILE

  Especificar un archivo de configuración alternativo

--preserve-ld-vars

  When clearing the environment internally, preserve all variables starting with LD_. This is mostly for debugging purposes.

--version

  Imprime la versión del demonio GDM.

--wait-for-go

  If started with this option, gdm will init, but only start the first local display and then wait for a GO message in the fifo protocol. No greeter will be shown until the GO message is sent. Also flexiserver requests will be denied and XDMCP will not be started until GO is given. This is useful for initialization scripts which wish to start X early, but where you don't yet want the user to start logging in. So the script would send the GO to the fifo once it is ready and GDM will then continue. This functionality was added in version 2.5.90.0.

#### Opciones de línea de comandos de `gdmsetup`

`gdmsetup` runs a graphical application for modifying the GDM configuration file. Normally on systems that support the PAM userhelper, this is setup such that when you run `gdmsetup` as an ordinary user, it will first ask you for your root password before starting. Otherwise, this application may only be run as root. This application supports standard GNOME options.

#### Opciones de línea de comandos de `gdm-restart`

`gdm-restart` para y reinicia GDM enviando al demonio de GDM una señal HUP. Este comando inmediatamente terminará todas las sesiones y echará fuera a los usuarios que hayan entrado con GDM.

#### Opciones de línea de comandos de `gdm-safe-restart`

`gdm-safe-restart` para y reinicia GDM enviando al demonio GDM una señal USR1. GDM re reiniciará tan pronto como todos los usuarios salgan.

#### Opciones de línea de comandos de `gdm-stop`

`gdm-stop` para GDM enviando al demonio GDM una señal TERM

### Comandos internos de GDM

The GDM package provides the following different commands in `libexecdir` intended to be used by the gdm daemon process.

#### Opciones de línea de comandos de `gdmchooser` y `gdmlogin`

The `gdmgreeter` and `gdmlogin` are two different login applications, either can be used by GDM. `gdmgreeter` is themeable with GDM themes while `gdmlogin` is themable with GTK+ themes. These applications are normally executed by the GDM daemon. Both commands support standard GNOME options.

#### Opciones de línea de comandos de `gdmchooser`

The `gdmchooser` is the XDMCP chooser application. The `gdmchooser` is normally executed by the GDM daemon. It supports the following options for XDM compatibility. This command supports standard GNOME options and is found in support standard GNOME options.

##### Opciones de línea de comandos de `gdmchooser`

--xdmaddress=SOCKET

  Socket para comunicación XDM.

--clientaddress=DIRECCIÓN

  Client address to return in response to XDM. This option is for running gdmchooser with XDM, and is not used within GDM.

--connectionType=TYPE

  Connection type to return in response to XDM. This option is for running gdmchooser with XDM, and is not used within GDM.

#### `gdm-ssh-session`

The `gdm-ssh-session` is normally executed by the GDM daemon when starting a secure remote connection through ssh. It does not take any options.

## Interfaz con temas

Esta sección describe la creación de temas para el Interfaz con temas. Para los ejemplos incluidos en las capturas, vea los temas estándar instalados y los temas del sitio web de temas.

### Descripción de los temas

GDM Themes can be created by creating an XML file that follows the specification in gui/greeter/greeter.dtd. Theme files are stored in the directory `<share>/gdm/themes/<theme_name>`. Usually this would be under `/usr/share`. The theme directory should contain a file called `GdmGreeterTheme.desktop` which has similar format to other .desktop files and looks like:

    [GdmGreeterTheme]
    Encoding=UTF-8
    Greeter=circles.xml
    Name=Circles
    Description=Theme with blue circles
    Author=Bond, James Bond
    Copyright=(c) 2002 Bond, James Bond
    Screenshot=screenshot.png

Los campos del nombre, descripción, autor y copyright pueden traducirse como otros archivos `.desktop`. Todos los archivos que se mencionan deberían estar en el propio directorio de temas. El campo Screenshot apunta a un archivo que debería ser una captura de 200x150 del tema en acción (está bien no tener una, pero lo hace más agradable al usuario). El campo Greeter apunta a un archivo xml que contiene descripciones del tema. La descripción se dará más tarde.

Once you have theme ready and installed you can test it with the installed `gdmthemetester` script. This script assumes that the X server supports Xnest. This command takes two arguments, first the environment that should be used. This is one of console, console-timed, flexi, remote-flexi, xdmcp. Where console is a standard console login, console-timed is a console login with a timed login going on, flexi is for any local flexible display, remote-flexi is for flexi displays that are not local (such as an Xnest flexiserver run from a remote display) and xdmcp is for remote XDMCP connections. The second argument is the theme name. So for example to test how things look in the XDMCP mode with the circles theme you would run:

    gdmthemetester xdmcp circles

Be sure to test all the environments with your theme, and make sure to test how the caps lock warning looks by pressing caps lock. This is also a good way to take screenshots, just take a screenshot of the Xnest window. This can be done in GNOME by focusing the Xnest window and pressing Alt-PrintScreen.

Once you have all this done, then make a tarball that contains the directory name (so that you could just untar it in the `<share>/gdm/themes` directory). And this is the tarball you distribute and people can install from the graphical configuration application. You can do this with the commands:

    cd <share>/gdm/themes
    tar czvf <theme_name>.tar.gz <theme_name>/

### Detailed Description of Theme XML format

#### greeter tag

The GDM theme format is specified in XML format contained within a <greeter> tag. You may specify a GTK+ theme to be used with this theme by using the gtk-theme element in the greeter tag as in the following example.

    <?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE greeter SYSTEM "greeter.dtd">
    <greeter gtk-theme="Crux">
    [...]
    </greeter>

Contained within the greeter tag can be the nodes described in the next sections of this document. Some of these nodes are containers (box nodes, rect item nodes) which can be used to organize how to display the nodes that the user sees and interacts with (such as button, pixmap and entry item nodes).

#### Nodos contenedores.

Box nodes are container nodes for item nodes. Box nodes are specified as follows:

    <box orientation="alignment" min-width="num"
    xpadding="num" ypadding="num" spacing="num"
    homogeneous="bool">

Where "num" means number and bool means either "true" or "false" The alignment value can be either "horizontal" or "vertical". If you leave any property off it will default to zero or "false" in case of "homogeneous" and "vertical" for the orientation.

Si la caja es homogénea entonces los hijos se les reserver la misma cantidad de espacio.

The "min-width" must be specified in pixels. Obviously there is also a corresponding "min-height" property as well.

#### Nodos fijos

Fixed is a container that has its children scattered about laid out with precise coordinates. The size of this container is the biggest rectangle that contains all the children. Fixed has no extra properties and so you just use:

    <fixed>

Then you put other items with proper position nodes inside this.

The "toplevel" node is really just like a fixed node.

#### Nodos de elemento

Un tema GDM se crea especificando una gerarquía de nodos de elementos y cajas. Los nodos de elementos pueden tener el siguiente valor para el tipo:

button

  A button field. This field uses a GTK+ button. It is also possible to make a "rect" item act like a button by setting its button element to true. However it is better to use GTK+ buttons in GDM themes since these are accessible to users with disabilities. Also, GTK+ buttons can be themed. This feature is supported in GDM 2.14.6 and later.

entry

  Campo de entrada de texto.

label

  Una etiqueta de texto. Debe tener un nodo "text" para especificar el texto.

list

  A face browser widget. Only useful if the face browser is enabled via the configuration.

pixmap

  Una imagen pixmap en un formato que gdk-pixbuf soporte como PNG, JPEG, Tiff, etc...)

rect

  Rectángulo.

svg

  Imagen Scaled Vector Graphic.

For example:

    <item type="label">

Items can specify ID values which gives them a specific look and feel or formatting. Furthermore you can customize the login process by adding custom widgets with custom id's for some items (currently only the list item)

Los elementos de entradas pueden tener valores id como siguen:

user-pw-entry

  Entry field for userid and password entry. This is the field used for responses for the PAM/GDM questions (Username, Password, etc..).

Los elementos de listas pueden tener valores id como siguen:

userlist

  A Face Browser list, so that users can pick their username by clicking on this instead of typing.

Furthermore, you can have an arbitrary id (I'd recommend starting the id with 'custom' not to conflict with future additions to this spec) and ask extra information of the user. See the section 'Custom Widgetry'

Label items can have id values as follows:

clock

  Etiqueta que muesta la fecha y la hora.

pam-prompt

  Label that displays the PAM prompt. This is the prompt that PAM uses to ask for username, password, etc...

pam-error

  Label that displayst PAM/GDM error messages. Such as when user can't log in.

pam-error-logo

  An image that will be displayed only when a pam-error message is being displayed. This is useful for displaying an "Attention" icon, for example. This feature is supported in GDM 2.14.6 and later.

pam-message

  Label that displays the PAM message. These are messages that PAM/GDM gives about state of the account, help about the prompts and other information.

timed-label

  Etiqueta que muestra la información de la entrada temporizada.

Los rectángulos pueden tener valores id como los siguientes:

caps-lock-warning

  Displays an icon that shows if the CAPS LOCK key is depressed. This rectangle will be hidden/shown appropriately

If an item is of type rect, the item can be a button. Buttons must also include a "button" value as follows:

    <item type="rect" id="disconnect_button" button="true">.

Los valores posibles para los ids de los botones son los siguientes:

chooser_button

  Ejecuta el selector XDMCP.

config_button

  Ejecuta la aplicación de configuración de GDM.

disconnect_button

  Desconecta de una sesión remota.

language_button

  Muestra el diálogo de selección del idioma.

halt_button

  Detiene (apaga) el sistema.

reboot_button

  Reinicia el sistema.

session_button

  Lista y selecciona las sesiones disponibles.

suspend_button

  Suspender el sistema.

system_button

  Realiza las opciones detener/reiniciar/suspender/etc (si están permitidas por la configuración de GSM). Además permite al usuario ejecutar el configurador si el usuario introduce la contraseña de root (otra vez si lo permite la configuración de GDM). Esto está normalmente ahora etiquetado como Acciones, y referido como el menú de Acciones.

#### Nodo de posición

Each item can specify its position and size via the "pos" node. For example:

    <pos x="0" y="4" width="100%" height="100%"/>

Tanto la posición como el tamaño pueden darse en porcentaje y se tomará como el porcentaje del tamaño del contenedor actual. Para los elementos de nivel superior su porcentaje es respecto de la pantalla completa.

For x and y, you can also specify a negative position which means position from the right or bottom edge. But this only applies with absolute coordinates. With percentage you can specify negative position and it will be still from the same edge.

The position also specifies the anchor of the item, this can be "n" "ne" "e" "se" "s" "sw" "w" and "nw" or "center" which stand for the different edges/corners or "center" for center. For example:

    <pos x="10%" y="50%" anchor="w" width="80%" height="95"/>

If the item contains a box, you can specify width and height to be "box" to mean that they are supposed to be the width and height of the box, that is the items in the box plus the padding.

If the item contains an SVG image, you can specify width and height to be "scale" to mean that the SVG image should be scaled to fit the requested area.

You can also specify an "expand" property to either be "true" or false. If true then the child will be expanded in the box as much as possible (that is it will be given more space if available).

There are two extra properties you can specify (as of 2.4.4.3) for labels (and labels only). The first is "max-width" which will specify the maximum width of the label in pixels. And the second is "max-screen-percent-width" which specifies the maximum percentage of the screen width that the label can occupy. By default no label will occupy more then 90% of the screen by width. An example may be:

    <item type="label">
    <pos x="10%" max-screen-percent-width="50%"/>

#### Mostrar nodo

Some items may only display in certain modes, like when doing a remote display. Multiple values can be specified and must be separated with commas. The following values are possible:

`console` - En modo consola.

`console-fixed` - In console non-flexi mode.

`console-flexi` - In console & flexi mode.

`flexi` - In flexi mode.

`remote` - In remote mode.

`remote-flexi` - In remote & flexi mode.

For example:

    <show modes="flexi,remote"/>

You can also specify the "type" value to indicate that certain items should only be displayed if the type is true. Valid values include the following:

`chooser`, si ChooserButton está puesto a «true» en la configuración de GDM.

`configurar`, si ConfigAvailable está puesto a «true» en la configuración de GDM.

`halt`, si HaltDaemon está especificado en la configuración de GDM.

`reiniciar`, si RebootCommand está especificado en la configuración de GDM.

`suspend`, si SuspendCommand está especificado en la configuración de GDM.

`system`, si SystemMenu está especificado en la configuración de GDM.

`timed`, si TimedLoginEnabled está puesto a "true" en la configuración de GDM.

For example:

    <show modes="console" type="system"/>

Note that if SystemMenu is off then the halt, restart, suspend, chooser and config choices will not be shown, so this is a global toggle for them all. See some of the standard themes for how the show modes are used.

#### Normal/Active/Prelight Nodes

Depending on the item type (except for userlist - refer to Color node below), it can specify its color, font, or image via the following tags:

`normal` - normal state.

`active` - when the item has active focus.

`prelight` - when the mouse is hovering over the item.

When item is "rect" (alpha can be omitted and defaults to 0.0):

    <normal color="#ffffff" alpha="0.0">

When item is "label"

    <normal color="#ffffff" font="Sans 14"/>

When the item type is "pixmap" or "SVG", then the normal, active, and prelight tags specify the images to use as follows:

    <normal file="picture.png" tint="#dddddd"/>

Note that relative pathnames are assumed to be in the same directory as the theme `.xml` file in `<share>/gdm/themes/<theme_name>`.

#### Face Browser Icon/Label Color Nodes

If the item type is of userlist, then the background color for the icon and label can be set separately via the the following tag:

    <color iconcolor="#dddddd" labelcolor="#ffffff"/>

#### Nodo de texto

Text tags are used by labels. They can be used to display localized text as follows (if the "xml:lang" attribute is omitted, the C locale is assumed):

    <text xml:lang="fr">Option</text>

You can include pango markup in the text nodes for labels, however you must encode it. So for example to have the label of "foo<sup>bar</sup>", you must type:

    <text>"foo<sup>bar</sup>"</text>

Text nodes can contain the following special character sequences which will be translated as follows:

%% - Un carácter literal %

%c - Clock time. Only labels with the "clock" id will update automatically every second. Other labels will contain a static timestamp.

%d - Display name (DISPLAY environment variable)

%h - Hostname (gethostname output)

%m - Machine name (uname.machine output)

%n - Node name (uname.nodename output)

%o - Domain name (getdomainname output)

%r - Release name (uname.release output)

%s - System name (uname.sysname output)

%t - Current timed delay value from configuration file (0 if off) followed by the word "seconds" if value is greater than 1 or the word "second" if the value is 1. This character sequence is intended to be only used internally to display the "timed-label" message, which is automatically updated every second.

%u - Timed username value from configuration file (empty if off) This character sequence is intended to be only used internally to display the "timed-label" message, which is automatically updated every second.

\n - Retorno de carro

_ - An underscore causes the following character to be underlined. If it precedes a % character sequence, the string that replaces the character sequence is underlined.

#### Stock

Ciertas etiquetas comunes localizadas pueden especificarse por medio de las etiquetas de fábrica. La etiqueta "text" se ignora si se usa la etiqueta "stock". Debería usar las etiquetas de fábrica en vez de poner todas las traducciones en los temas. Esto da tiempos de carga más rápidos y mejores traducciones. Los valores siguientes son válidos:

`cancel`, _("_Cancelar"

`caps-lock-warning`, _("La tecla BloqMayús está activada."

`chooser`, _("Remote Login via _XDMCP"

`config`, _("_Configurar"

`disconnect`, _("D_esconectar"

`halt`, _("_Apagar")

`language`, _("_Idioma"

`ok`, _("_Aceptar"

`quit`, _("_Salir"

`reboot`, _("_Reiniciar"

`session`, _("_Sesión"

`startover`, _("_Start Over"

`suspend`, _("Sus_pender"

`system`, _("_Acciones" (Anteriormente "S_istema"

`timed-label`, _("El usuario %u entrará en %t"

`username-label`, _("Usuario:"

`welcome-label`, _("Bienvenido a %n"

For example:

    <stock type="welcome-label">

#### Widgets personalizados

Actualmente hay un elemento que puede ser personalizable y este es el elemento de la lista. Si necesita preguntar al usuario cosas adicionales, como para escoger de una lista o lugares desde donde entrar, o establecer un conjunto de sesiones de entrada personalizadas puede configurar el elemento de la lista y añadir hijos del elemento de la lista que describan las selecciones. Cada elemento de la lista debe tener un id y un texto hijo. La elección será grabada en el archivo `<ServAuthDir>/<display>.GreeterInfo` como `<list id>=<listitem id>`.

Por ejemplo suponga que estamos en la pantalla 0, `ServAuthDir` es `/var/gdm` y necesitamos tener lo siguiente en el tema:

    <item type="list" id="custom-config">
    <pos anchor="nw" x="1" y="1" height="200" width="100">
    <listitem id="foo">
    <text>Foo</text>
    </listitem>
    <listitem id="bar">
    <text>Bar</text>
    </listitem>
    </item>

Then if the user chooses 'Foo' then `<var>/gdm/:0.GreeterInfo` will contain:

    custom-config=foo

## Accesibilidad

GDM supports "Accessible Login" to allow users to log in to their desktop session even if they cannot easily use the screen, mouse, or keyboard in the usual way. Only the "Standard Greeter" supports accessibility, so use this login GUI for accessibility support. This is done by specifying the "Standard Greeter" in the "Local" tab for the console display and specifying the "Standard Greeter" in the "Remote" tab for remote displays. Or you can modify the `Greeter` configuration option by hand to be `gdmlogin`.

The Standard Greeter supports the ability to launch assistive technologies at login time via configurable "gestures" from the standard keyboard, pointing device, or switch device attached to the USB or PS/2 mouse port. Also the user can change the visual appearance of the login UI before logging in, for instance to use a higher-contrast color scheme for better visibility.

### Configuración de accesibilidad

Para activar la entrada accesible, el administrador del sistema debe hacer algunos cambios a la configuración predeterminada de entrada modificando manualmente tres archivos de configuración almacenados en la configuración de GDM, AccessKeyMouseEvents y AccessDwellMouseEvents.

Para permitir a los usuarios cambiar el color y el contrarte del diálogo de entrada, asegúrese de que el parámetro `AllowThemeChange` en la configuración de GDM está puesto a «true».

Para restringir los cambios del usuario a la apariencia visual a un subconjunto de los temas disponibles, el parámetro `GtkThemesToAllow` en la configuración de GDM puede establecerse a una lista de temas aceptables separados por comas. Por ejemplo:

    GtkThemesToAllow=HighContrast,HighContrastInverse

Para activar el uso de tecnologías de asistencia como el teclado en pantalla, el lector de pantalla o la Lupa, el parámetro `AddGtkModules` en la configuración de GDM debe descomentarse y establecerse a «true». Además el parámetro `GtkModulesList` debe ser descomentado y establecido como sigue:

    GtkModulesList=gail:atk-bridge:dwellmouselistener:keymouselistener

Los administradores de sistema quizá deseen cargar sólo un subconjunto mínimo de estos módulos que se requieren para soportar su base de usuarios. Dependiendo de las necesidades de los usuarios finales, no todos los GtkModules necesitan ser cargados. Si sus usuarios finales necesitan el lector de pantalla integrado y la lupa, debe incuir «gail» y «atk-bridge». Si sus usuarios finales estarán usando un dispositivo apuntador sin botones o interruptores, incluya «dwellmouselistener». si algunos de sus usuarios usarán dispositivos apuntadores con interruptores, alternativos a teclados físicos o despositivos de botones, incluya «keymouselistener». Incluir los cuatro es apropiado para la mayoría de las configuraciones del sistema. El teclado en pantalla puede funcionar singail o atk-bridge, pero con un conjunto de características reducido; paa accesibilidad optima recomendamos incluir tanto gail como atk-bridge.

Once "keymouselistener" and/or "dwellmouselistener" have been added to the GtkModules loaded by GDM, you can assign end-user actions with the launching of specific assistive technologies. These gesture associations are contained in files AccessKeyMouseEvents and AccessDwellMouseEvents, respectively. Both files are located in the <etc>/gdm/modules directory. The gesture format is described in the two configuration files.

The AccessKeyMouseEvents file controls the keymouselistener Gesture Listener and is used to define key-press, mouse button, or XInput device sequences that can be used to launch applications needed for accessibility. In order to reduce the likelihood of unintentional launch, these "gestures" may be associated with multiple switch presses and/or minimum durations. Note that the XKB extension is needed for key gestures to work, so you may need to add +xkb to your Xserver command line for gestures to work properly.

The DwellKeyMouseEvents file controls the dwellmouselistner and supports gestures that involve only motion of a pointing device such as the system mouse of an alternative pointing device such as a head pointer or trackball may also be defined. All gestures are specified by the same syntax; that is, there is no distinction between a "core mouse" gesture and motion from an alternate input device.

Motion gestures are defined as "crossing events" into and out of the login dialog window. If the "dwellmouselistener" GtkModule is loaded, alternative pointing devices are temporarily "latched" to the core pointer, such that motion from alternative devices results in movement of the onscreen pointer.

In order to use text-to-speech services at login time (for instance, when using the Screen Reader in speech mode) on some operating systems, the GDM user must be made a member of the "audio" group

Currently GDM does not remember what accessible technology programs have been started when switching applications. So if the user switches between the login program and the chooser, for example, then it is necessary for the user to redo the gesture. Users may need to also set up their default session so that the assistive technologies required are started automatically (or have appropriate key-bindings defined to start them) after the user session has started.

There are some issues that cause users to have problems getting the gesture listeners to work. It is recommended that people use GDM version 2.8.0.5 or later for best results. Some X servers have a bug which causes detectable autorepeat to fail when XEVIE is enabled (which happens when atk-bridge is included as a GTK Module). This bug causes key gestures with a duration greater than 0 to always fail. A workaround is to simply redefine all key gestures so they have zero length duration. Some versions of GOK and gnopernicus will not launch unless the "gdm" user has a writable home directory. If you see an hourglass cursor when you complete a gesture but the program does not start, then you are likely having this problem. It should be considered a bug for AT programs to require having a writable home directory, so please file a bug with the AT program if you encounter this problem. Also note that some input devices require X server configuration before GDM will recognize them.

### Configuración de sonido de accesibilidad en la entrada

By default, GDM requires a media application such as "sox" to be present to play sounds for successful or failed login. GDM defaults the location of this application to `<bin>/play` (or `<bin>/audioplay` on Solaris. This can be changed via the SoundProgram GDM configuration option. Typically most text-to-speech programs (such as ORCA or Gnopernicus) use a separate mechanism to play audio.

## Características específicas de Solaris

### Solaris Configuration

On Solaris, the following configuration is recommended. This turns on IPv6 and also turns on PreFetch for performance benefit.

    ./autogen.sh --prefix=/usr --sysconfdir=/etc/X11 --localstatedir=/var
       --libexecdir=/usr/lib --enable-ipv6=yes --with-at-bindir=/usr/sfw/bin
       --with-prefetch --with-post-path=/usr/openwin/bin

Configuring GDM with the "--with-post-path=/usr/openwin/bin" on Solaris is recommended for access to programs like Xnest.

### Solaris /etc/logindevperm

GDM supports /etc/logindevperm, but only on Solaris 10 and higher. Refer to the logindevperm.4 man page for more information.

To make /etc/logindevperm functionality work on Solaris 9 or earlier you would have to hack the GDM PreSession and PostSession script to chmod the device permissions directly. In other words, if /etc/logindevperm had a listing like this:

    /dev/console    0600    /dev/sound/*            # audio devices

The PreSession script would need to be modified to chown /dev/console to the user:group who is logging into the console and ensure whatever permissions is specified in /etc/logindevperm (0600 for the line above). Then in the PostSession script chmod the device back to root:root and ensure 0600 this time (do not use the value in the /etc/logindevperm file). Linux uses a different mechanism for managing device permissions, so this extra scripting is not needed.

### Solaris Automatic Login

Automatic login does not work on Solaris because PAM is not configured to support this feature by default. Automatic login is a GDM feature that is not enabled by default, so you would only notice this problem if you try to make use of it. Turning this feature on causes your computer to login to a specified username on startup without asking for username and password. This is an unsecure way to set up your computer.

If using Solaris 10 or lower, then you need to compile the pam_allow.c code provided with the GDM release and install it to /usr/lib/security (or provide the full path in /etc/pam.conf) and ensure it is owned by uid 0 and not group or world writable.

The following are reasonable pam.conf values for turning on automatic login in GDM. Make sure to read the PAM documentation (e.g. pam.d/pam.conf man page) and be comfortable with the security implications of any changes you intend to make to your configuration.

           gdm-autologin auth  required    pam_unix_cred.so.1
           gdm-autologin auth  sufficient  pam_allow.so.1
           gdm-autologin account  sufficient  pam_allow.so.1
           gdm-autologin session  sufficient  pam_allow.so.1
           gdm-autologin password  sufficient  pam_allow.so.1

The above setup will cause no lastlog entry to be generated. If a lastlog entry is desired, then use the following for session:

           gdm-autologin session required pam_unix_session.so.1

### Other Solaris Features

GDM soporta unas pocas características específicas a Solaris, como las siguientes:

GDM supports Solaris Auditing if running on Solaris 10 or higher. GDM should not be used if auditing is needed and running Solaris 9 or older.

GDM supports a security feature which causes the X server to run as the user instead of as the root user. GDM must be using PAM for this feature to be enabled, which is the normal case for Solaris. This second feature has the side-effect of causing the X server to always restart between sessions, which disables the AlwaysRestartServer configuration option.

Solaris supports the `/etc/default/login` interface, which affects the `DefaultPath`, `RootPath`, `PasswordRequired`, and `AllowRemoteRoot` options as described in the "Configuration" section.

## Configuraciones de ejemplo

Esta sección tiene algunas configuraciones de ejemplo que son útiles para varias configuraciones.

### Terminal Lab With One Server

Suppose you want to make a lab full of X terminals that all connect to one server machine. So let's call one X terminal `xterminal` and let's call the server machine `appserver`. You install GDM on both.

On `appserver` you enable XDMCP, so you have

    [xdmcp]
    Enable=true

If you want no local screens here, you can then make the `[servers]` section empty.

On the `xterminal` you disable XDMCP (you don't want anyone to connect to the xterminal really). You will add a server type perhaps called `Terminal` as follows:

    [server-Terminal]
    name=Terminal server
    command=/path/to/X -terminate
    flexible=false
    handled=false

This definition should in fact be included in the standard configuration file. Notice that we made the `handled` key false since we don't want GDM to handle this server localy. Also note that we have not yet added the `-query` argument, you can add that here, or in the `[servers]` section. We'll define our local servers as follows:

    [servers]
    0=Terminal -query appserver

This will run a direct XDMCP query to the server named `appserver`.

### Laboratorio con terminales con dos o más servidores

Suponga que quiere hacer un laboratorio lleno de terminales X que todas se conectan a una selección de servidores. Por ahora llamémoslos `appserveruno` y`appserverdos`. De nuevo llamamos a nuestro servidor de terminales X `xterminal`. La configuración de ambos servidores es la mismoa que con el caso de un servidor en la sección anterior. No necesita activar explícitamente las consultas indirectas en el servidor debido a que ejecutamos los selectores localmente en las terminales X.

So on the `xterminal` you again disable XDMCP. You will add a server type perhaps called `Chooser` as follows:

    [server-Chooser]
    name=Chooser server
    command=/path/to/X
    flexible=false
    chooser=true

And again this definition should in fact be included in the standard configuration file. Notice that we made the `chooser` key true here. This will run the XDMCP chooser for this server, and when the user chooses a host GDM will run a query for that host. Then we will define our local servers as follows:

    [servers]
    0=Chooser

The XDMCP chooser on the X terminal will normally give a broadcast query to see which servers exist on the network. If the two servers are not reachable by a broadcast query, you must add them by hand to the configuration file. So in the `[chooser]` section you would have:

    Hosts=appserverone,appservertwo

and any other servers you wish the users to be able to connect to.

Sometimes you may want to run the chooser on the server side however. Then what you want to do is to run a configuration similar to the previous section about the one server configuration with XDMCP indirect queries enabled on `appserver` and on the X terminals you'd have

    [servers]
    0=Terminal -indirect appserver

This way for example you only have to maintain one `Hosts` entry. However as a disadvantage then, the `appserver` must then always be available. So it's not good for situations where you want to have several servers and not all of them have to be on all the time. You could also have one of the X terminals handle indirect XDMCP queries and serve up the chooser to the other X terminals.

## Troubleshooting

This section discusses helpful tips for getting GDM working. In general, if you have a problem using GDM, you can submit a bug to the "gdm" category in bugzilla.gnome.org or send an email to the

    gdm-list@gnome.org

mail list.

If GDM is failing to work properly, it is always a good idea to include debug information. Use the `gdmsetup` command to turn on debug ("Enable debug messages to system log" checkbox in the "Security" tab), then use GDM to the point where it fails, and include the GDM output sent to your system log (`<var>/log/messages` or `<var>/adm/messages` depending on your operating system). Since the system log can be large, please only include the GDM debug information and do not sent the entire file. If you do not see any GDM syslog output, you may need to configure syslog (see syslog.3c man page).

You should not leave debug on after collecting data. It will clutter your syslog and slow system performance.

### GDM Will Not Start

There are a many problems that can cause GDM to fail to start, but this section will discuss a few common problems and how to approach tracking down a problem with GDM starting. Some problems will cause GDM to respond with an error message or dialog when it tries to start, but it can be difficult to track down problems when GDM fails silently.

First make sure that the Xserver is configured properly. The GDM configuration file contains a command in the [server-Standard] section that is used for starting the Xserver. Verify that this command works on your system. Running this command from the console should start the Xserver. If it fails, then the problem is likely with your Xserver configuration. Refer to your Xserver error log for an idea of what the problem may be. The problem may also be that your Xserver requires different command-line options. If so, then modify the Xserver command in the GDM configuration file so that it is correct for your system.

Another common problem is that the GDM greeter program is having trouble starting. This can happen, for example, if GDM cannot find a needed library or other resource. Try starting the Xserver and a terminal program, set the shell environment variable DOING_GDM_DEVELOPMENT=1 and run `<lib>/gdmlogin` or `<lib>/gdmgreeter`. Any error messages echoed to the terminal will likely highlight the problem. Also, turning on debug and checking the output sent to the system log will often highlight the problem.

Also make sure that the `/tmp` directory has reasonable ownership and permissions, and that the machine's file system is not full. These problems will cause GDM to fail to start.

### GDM Will Not Access User Settings

GDM saves user settings, such as your default session and default language, in the `~/.dmrc`. Other files, such as the user's `~/.Xauthority` file will also affect login. GDM, by default, is strict about how it tries to access files in the users home directory, and will ignore the file if they do not conform to certain rules. You can use the `RelaxPermissions` configuration option to make GDM less strict about how it accesses files in the user's home directory, or correct the permissions issues that cause GDM to ignore the file. This is discussed in detail described in the "File Access" section of the "Overview".

## Licencia

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

A copy of the GNU General Public License is included as an appendix to the GNOME Users Guide. You may also obtain a copy of the GNU General Public License from the Free Software Foundation by visiting their Web site or by writing to

     Free Software Foundation, Inc. 59 Temple Place - Suite 330 Boston, MA02111-1307USA