Autologin set on update, without being asked

I have just made an update of a Manjaro Cinnamon, and saw this:

$ sudo pacman -Syu

(428/597) upgrading lightdm-settings                                           [############################################] 100%

==> NOTE: We have enabled autologin for all users.
==> NOTE: Reboot your system the first time, so changes will take affect.

This was performed when updating lightdm to lightdm-settings-1.6.1-1-any, apparently.

I cannot think of one good reason to force all users in autologin in an update, without asking the admin and without more than a one-line warning. In my opinion this introduces a serious breach of security; what I don’t know is whether this is specific to the Manjaro XFCE distribution or to lightdm in general.

If I look at the /etc/groups file, I can indeed see that a last line was added with all users in the autologin group.

Strangely, autologin-user was not set in /etc/lightdm/lightdm.conf and from what I understand this is how autologin should be set with lightdm, but I may be wrong since I’ve never enabled this.

Is it normal behaviour?

Package lightdm-settings is not included in Manjaro Xfce ISO, but is included in ISOs for Mate, Cinnamon and i3wm
(it might be needed only for Manjaro user autologin on Live ISO)

package was last updated 2022-12-02

Manjaro x64 2022-12-20 Stable Update

:: Package changes (Tue Dec 20 05:52:00 CET 2022)

 lightdm-settings              1.6.0-1              1.6.1-1

Last update for lightdm ( 1:1.32.0-1 to 1:1.32.0-4) was [Stable Update] 2022-09-12

I would expect that data from pacman log for both packages should confirm that package lightdm was not replaced by lightdm-settings

grep -e 'lightdm ' -e 'lightdm-settings' /var/log/pacman.log 

I also suspect lightdm-settings may have been installed for some time and was not forced by a recent update

lightdm-settings creates a systemd service add-autologin-group.service and a script add-autologin-group.script to set autologin for all users

I have never had lightdm-settings installed on this system. Autologin was enabled by the usual method of editing /etc/lightdm/lightdm.conf
ArchWiki - LightDM - Enabling autologin

3 Likes

I think so, I get it every now and again. AFAIK know it only adds the users to the autologin group, someone seems to think this makes things more convenient. It doesn’t enable autologin.

I’m sorry, you’re right. It’s a Manjaro Cinnamon installation. Maybe I should remove this and post it in the appropriate forum.

I had always used XFCE, so force of habit…

That’s what it says, but since the script doesn’t set the autologin-user in lightdm.conf file, thankfully there’s a small safeguard. But if the admin had already set the autologin-user, then this update would effectively remove the login procedure. So in my view, it’s not normal and it’s even dangerous.

What’s more, I realized that it was resetting the group file to add everyone to autologin every time the OS boots. I don’t know what went through the head of whoever did this.

Now I’ll have to figure out how to remove this service permanently, since from other posts it seems to be re-installed on each update of lightdm.

When I said normal I meant that it normally happens, not that it should happen etc.

If the admin has set the autologin user then presumably they want and already have autologin. If they haven’t then there’s still no autologin. I agree it’s silly, but I don’t see a major issue except with the wording of the message.

I presume it’s to make it easier for newbies to set autologin. :man_shrugging:

Well nothing depends on it so you can remove lightdm-settings or try masking it:

systemctl mask add-autologin-group
1 Like

This topic was automatically closed 2 days after the last reply. New replies are no longer allowed.