Lock screen requires password from 'No password' account

[gur]

Switched from Windows To Linux Mint 17.2 cinnamon on a new computer.
Created multiple accounts:

• 'standard' accounts for each of my young kids with 'nopasswdlogin'.
• 'standard' account for myself with password.
• Admin account with password.

Scenario:
1. Log to an account without passord. OK.
2. Screen lock is triggered either manually or due to a timeout.
3. Password is required (?). Empty password is not accepted.
4. Must click 'switch user' and select user from main login screen.

Did some searching. Found the link below. Don't know if it is related and how to apply it.
https://bugs.launchpad.net/ubuntu/+sour ... ug/1314095

Best fix would be to require no password from lock screen for my kids account but still require password for other accounts.
Alternate fix would be for lock screen to accept empty password.

Please help.
Thanks,
Gur

[xenopeek]

Welcome to the Linux Mint forums.

In System Settings > Screensaver, on the Settings tab (in the tab bar near top of the window), you can disable the screen locking on screen blank and disable it when computer is idle. That takes care of timeouts.

In System Settings > Keyboard, on the Shortcuts tab, in the System category (left sidebar), you can remove the configured shortcuts for Lock screen. That disables triggering it accidentally from the keyboard.

The only one not easy to disable is the Lock screen button in the menu. That's part of the Cinnamon Menu applet and can't be configured, though you can edit the applet to remove it. To do that run the command:

Code: Select all

gksudo gedit /usr/share/cinnamon/applets/menu@cinnamon.org/applet.js

Search for "lock" and remove this part (all the code between the "//Lock screen" line and the "//Logout button" line about 30 lines down):

Code: Select all

        //Lock screen
        let button = new SystemButton(this, "system-lock-screen", launchers.length + 3,
                                      _("Lock screen"),
                                      _("Lock the screen"));

        this._addEnterEvent(button, Lang.bind(this, this._favEnterEvent, button));
        button.actor.connect('leave-event', Lang.bind(this, this._favLeaveEvent, button));

        button.activate = Lang.bind(this, function() {
            this.menu.close();

            let screensaver_settings = new Gio.Settings({ schema: "org.cinnamon.desktop.screensaver" });
            let screensaver_dialog = Gio.file_new_for_path("/usr/bin/cinnamon-screensaver-command");    
            if (screensaver_dialog.query_exists(null)) {
                if (screensaver_settings.get_boolean("ask-for-away-message")) {                                    
                    Util.spawnCommandLine("cinnamon-screensaver-lock-dialog");
                }
                else {
                    Util.spawnCommandLine("cinnamon-screensaver-command --lock");
                }
            }
            else {                
                this._screenSaverProxy.LockRemote();
            }                        
        });
        
        this.favoritesBox.add_actor(button.actor, { y_align: St.Align.END, y_fill: false }); 

Alternative would be to install another menu applet, that either doesn't have the lock screen button or has it configurable.

[gur]

I really hope for a solution that solves the password issue rather than disable the lock screen completely.
The link I included describes a similar bug when LDAP accounts are used. What is LDAP? Does it relate in any way to 'nopasswdlogin' accounts?
Can I somehow assign empty password to the 'no password' accounts so they can easily be 'unlocked'?

[xenopeek]

LDAP is <look it up on wikipedia yourself >. In short, LDAP would have accounts stored on a server instead of on the computer. Not relevant here.

You can delete the password on accounts. That should allow you to login without needing to type a password and also disable the lock screen password prompt. You need to be logged in as an administrator and then you can run the command:

Code: Select all

sudo passwd -d username

Where you replace username with the username of the account you wish to delete the password for. At least on test here with Linux Mint 17.2 Cinnamon it worked.

[gur]

I think I found a solution I will appreciate if some expert check its validity.
The file /etc/pam.d/cinnamon-screensaver looked like that:

Code: Select all

@include common-auth
auth optional pam_gnome_keyring.so

I copied the first 2 lines from /etc/pam.d/mdm into the beginning so it now looks like that

Code: Select all

auth    requisite       pam_nologin.so
auth    sufficient      pam_succeed_if.so user ingroup nopasswdlogin
@include common-auth
auth optional pam_gnome_keyring.so

It seems that lock screen of 'no password' user enters scrrenserver and released with any mouse move while user with a password experience normal lock screen.

Update:
After reading some more PAM documentation I understand that the pam_nologin.so is not required since the user is already loged in. So /etc/pam.d/cinnamon-screensaver should look like that:

Code: Select all

auth    sufficient      pam_succeed_if.so user ingroup nopasswdlogin
@include common-auth
auth optional pam_gnome_keyring.so

[MtnDewManiac]

There's a reason that it is called "Lock Screen," lol .

The following may be completely irrelevant, because I use Xfce instead of Cinnamon. I am wondering if the apps involved are "generic," as opposed to ones written specifically for Xfce and Cinnamon. I'm thinking that they might be, as I don't see any benefit of reinventing the wheel, as it were.

Anyway, I use XScreenSaver. On my system, it isn't set up to require a password. Neither is any kind of sleep/suspend/et cetera. I only need my password to log in initially.

I happened to read your post/thread, and was assuming that "lock screen" meant that the screensaver was requiring you to enter a password to unlock it. Then I read further and thought, "Hmm..." So I opened Xfce's menu and - not expecting to find anything at that point - typed "lo" and saw Lock Screen appear at the top of the application list. "Huh," I thought, "It's an actual application." I proceeded to run it, which started xscreensaver. I figured that's all it did, but when I tapped a key to abolish it, I was presented with the "XScreenSaver 5.15" dialog box that asks for the user's password.

So... I think you ought to be able to configure your system so that you have the normal screensaver/blanker/timewaster application that doesn't require a password, yet still retain the ability to run Lock Screen (which appears to be the same thing, other than requiring a password." In a perfect world, all of that would be configurable on a per-user basis. IDK know if that is the case, though.

Some time and a few distros ago, I was running Ultimate Edition. IIRC (I might not be, but believe I am), when I ran Synaptic Package Manager to install (etc.) applications, I was prompted for the administrator password. If I entered it, any applications that I installed would be available to all users. However, if I didn't, I could still install applications - but they would be available for that user only. I suppose, in that scenario, it would be possible to install separate "existences" of the relevant application(s) for each user and that the configurations for each would be completely separate. But this way of functioning for Synaptic Package Manager doesn't seem to be available in Mint. You either enter the administrator password or you are not allowed to run it. IDK what's up with that. But I suspect (well... hope) that the settings for applications such as XScreenSaver (and Screen Lock, if it is a standalone app) are in each user's /home/ directory and not a "one set per system" type setup.

Regards,
MDM

[xenopeek]

The following may be completely irrelevant, because I use Xfce instead of Cinnamon.

Would that I could have cut in there Indeed, Cinnamon doesn't use Xscreensaver but cinnamon-screensaver.

[MtnDewManiac]

Is it a case where it's incompatible - and, therefore, cannot be installed/used - or is it just one of those things that they renamed and changed a thing or two (or not) so that they could say it's a Cinnamon app? (Sorry if I offend someone, but I don't know how else to phrase that question, lol.)

It'd be nice if it's the latter, since (as I mentioned) all that stuff works fine with XScreenSaver / Lock Screen . Well, not nice, exactly, since that would sort of be evidence of time-wasting on the part of Cinnamon's developers - but it'd sure be convenient .

Regards,
MDM

[xenopeek]

It's not a copy of Xscreensaver. Looks like it started out as a fork of GNOME's screensaver. Instead of showing animations like Xscreensaver does, it blanks the display and puts it in power save mode. Anyway, this is all doesn't help OP one bit so let's drop it.

[MtnDewManiac]

It's not a copy of Xscreensaver. Looks like it started out as a fork of GNOME's screensaver. Instead of showing animations like Xscreensaver does, it blanks the display and puts it in power save mode. Anyway, this is all doesn't help OP one bit so let's drop it.

Okay, yeah, you're right, if Cinnamon is set up so that the user is unable to uninstall its version of the screensaver/blanker and install XScreenSaver and use it instead, then my speculation isn't helping the OP. Assuming that you're correct in that (and you probably are, as you seem quite knowledgeable), I'll comment no more and close with this: Gur, my apologies for wasting your time.

Regards,
MDM