Lock screen after auto login Debian/Ubuntu

Question

My situation:

1. Need auto login for my Wheezy.

2. Sometimes I'm away from my PC when it rebootsso I need to lock the screen after auto login.

When I type /usr/bin/gnome-screensaver-command -l it locks fine. But adding it to startup applications somehow does not work.

Any ideas how to solve my problem?

Solution

Create executable script and add it to startup applications instead of screensaver initialization; this should work fine:

/usr/bin/gnome-screensaver &
sleep 1
/usr/bin/gnome-screensaver-command -l

When you add gnome-screensaver-command -l to startup, it runs when screensaver isn't fully initialized. Because of that it doesn't work.

Comments

[pcnate]

I'm surprised this is not a built in option. Works well though. Any ideas about how insecure this might be?

[tcnj]

@pcnate depends if physical access is part of your threat model. If it is, then security hinges on data encryption. If it isn't, it's irrelevant as this only affects physical access.

[pcnate]

@tcnj I meant the option to securely create a user session without ever unlocking the screen. Sessions starts, performs auto launches etc but having the locked screen and never rendering any of it to a visible monitor and never accepting any input from hardware until the lock screen provides authenticated access to that session

[tcnj]

@pcnate I was trying to communicate the fact that if they have the physical access to the device, there are plenty of ways to gain a root shell or equivalent anyway, making it slightly pointless.

[Klaws]

@tcnj Indeed, physical access equals root access. The only thing it does it to look "secure". In some companies, there are policies that a screen must automatically lock withing three minutes after one leaves his desk...for security. I know, your rib cage is now hurting pretty bad from laughing, but the answer could be exactly what's needed to pacify the "security experts".