[solved] lightdm created tty session not password protected

[Mgiese]

hi guys,

as the title suggests, i am using lightdm

when logging in with one user then "switching" (function of xfce4) to another user, i get 2 active sessions:

tty6 user1
tty7 user2

the problem is, that i can switch both ttys without entering passwords for the respective user

this is desktop-environment independently, happens from xfc4 to another DE, and vice versa

i don`t know if this is a lightdm bug, or a missconfiguration on my side or even a gentoo related bug


any help is very much appriciated
_________________
I do not have a Superman complex, for I am God not Superman

Ryzen9 7950x ; Geforce1650 ; kernel 6.5 ; XFCE

[Hu]

Switching terminals is not password-protected. If you require security, then the protected user needs to use a screen-locking utility, so that when you arrive at that user's terminal, the only things you can do are give the user's password or switch to a different terminal. If you don't use a screen-locker, then you have the related problem that a user who walks away leaves their session unprotected and available to whoever walks up to the computer next.

[Mgiese]

i am not sure you get the extend of this.

i am logged in as a user. then i use the xfce button "log out". there i have several options, one of them is "switch user". as i do this, the screen should now automatically be locked. but it is not.... and i`d say this is a security flaw. OK, i will give your suggestion a try and look for screen-locker for xfce..

cheers
_________________
I do not have a Superman complex, for I am God not Superman

Ryzen9 7950x ; Geforce1650 ; kernel 6.5 ; XFCE

[Mgiese]

ok , solved, i just enabled in the xfce4 screensaver section "Lock Screen"

thanks
_________________
I do not have a Superman complex, for I am God not Superman

Ryzen9 7950x ; Geforce1650 ; kernel 6.5 ; XFCE

[Hu]

If the button labeled "Log out" does not in fact log out the user, I would say that is a bug. It should not be labeled "Log out" if that is not what it does.

A desktop-assisted user switch ought to be able to automatically lock the source terminal, though in some environments the administrator may not want the burden that brings. My point was that if you use the Xorg tty-switch hotkey, which is available independent of your desktop, you can go to any tty, and if the destination tty is unlocked, then yes, you have an access control problem. That is not a problem with the tty-switch functionality; it is a problem with the individual users' environments not enforcing access control.

[Mgiese]