7

I want a guest account just like in Ubuntu which has following features:

  1. It does not require password to login
  2. A new home folder (in /tmp if possible) is created with no data every time
  3. User data is deleted as soon as he/she logs out
  4. User can not use sudo

I am running Gnome 3.20 on Arch Linux

NOTE: please don't close my question as duplicate of Create guest account with restricted access to applications because that question does not have answers to my 2nd and 3rd point

  • This is relevant. Perhaps even a dupe if the answer works for you: Create guest account with restricted access to applications. – terdon Jan 29 '16 at 14:31
  • @terdon it looks like a work around and not exactly like Ubuntu – Edward Torvalds Jan 29 '16 at 14:32
  • I have no idea how Ubuntu does it. If you need "exactly like Ubuntu", you'll have to edit your question and explain what that means. However, the links provided in the linked answer give the ways you can limit a user's authority and are almost certainly how Ubuntu has implemented whatever they've implemented behind the scenes. Try it. – terdon Jan 29 '16 at 14:34
9

It turns out it's quite simple with GDM. I assume you're using GDM since you're also using Gnome. First, create the guest user account with a blank password:

sudo useradd -d /tmp/guest -p $(openssl passwd "") guest

The openssl passwd "" will return the hash of the empty string, thereby setting the password to blank.

Now, all you need are these two scripts:

  • /etc/gdm/PostLogin/Default

    This is executed after you log in and will create the /tmp/$guestuser (/tmp/guest by default) directory and copy the default files from /etc/skel to it. To change the default username for the guest user, set guestuser to something else at the beginning.

    #!/bin/sh
    
    guestuser="guest"
    
    ## Set up guest user session
    if [[ "$USER" = "$guestuser" ]]; then
        mkdir /tmp/"$guestuser"
        cp /etc/skel/.* /tmp/"$guestuser"
        chown -R "$guestuser":"$guestuser" /tmp/"$guestuser"
    fi
    exit 0
    
  • /etc/gdm/PostSession/Default

    This is executed after you log out and will remove the /etc/$guestuser directory and all its contents. Make sure to set guestuser to the same value in both scripts.

    #!/bin/sh
    
    guestuser="guest"
    
    ## Clear up the guest user session
    if [[ "$USER" = "$guestuser" ]]; then
        rm -rf /tmp/"$guestuser"
    fi
    
    exit 0
    

Finally, make the two scripts executable:

sudo chmod 755 /etc/gdm/PostLogin/Default  /etc/gdm/PostSession/Default

Now, just log out and you will see your new guest user. You can log in by selecting it and hitting Enter when prompted for a password. The guest user won't be able to use sudo since that is the default for all users anyway. Only users explicitly mentioned in /etc/sudoers or those who are members of groups explicitly mentioned in sudoers (such as wheel or sudo, depending on your distribution) can use sudo.


If you are using a recent version of GDM, it may disable the login button while the password box is empty. To work around this you can tell GDM not to prompt for the password for specific groups. The caveat is that this will also bypass the session selection menu for members of that group. If you want to do this you should add this line at the beginning of /etc/pam.d/gdm-password:

auth sufficient pam_succeed_if.so user ingroup guest
  • why do you have to chmod those files? there is no need of that, because those scripts are run by root – Edward Torvalds Jan 29 '16 at 19:13
  • 1
    @edwardtorvalds so? What difference does that make? Root can't execute non-executable files. And yes, you do need it because I tried it without making them executable and it failed. It would appear the scripts are being run directly (/path/to/script) and not as arguments to sh. Which makes sense since the examples provided included a shebang line. – terdon Jan 29 '16 at 19:17
  • On Login screen, your solution requires to press enter without entering anything which worked in 3.16. In newer gnome (probably from 3.18) you cannot press enter without entering anything. so work around is to keep hashed password section in /etc/shadow empty. – Edward Torvalds Apr 13 '16 at 12:28
  • since /tmp/guest/ folder does not exists on startup, shadow service of systemd is failing every time – Edward Torvalds May 8 '16 at 6:03
  • 1
    @MattSturgeon yeah, it seems perfectly reasonable, I just asked because since I haven't tested it, I couldn't know whether it works. Great edit, thanks! – terdon Mar 16 '17 at 15:58
2

You could make use of logoff scripts. There you can delete the home folder for your guest account and create a new one on logout. If necessary, you could make it sudoable by the guest account via visudo. Add yourguestacc ALL=(root) NOPASSWD: /path/to/script/recreating/the/home/folder. See the arch wiki for further information.

protected by Community Aug 30 '17 at 21:31

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.