<!DOCTYPE book PUBLIC "-//Davenport//DTD DocBook V3.0//EN" []>

<book id="gdm">
  <bookinfo>
    <title>Gnome Display Manager Reference Manual</title>
    <authorgroup>
      <author>
        <firstname>Martin</firstname><othername>K.</othername><surname>Petersen</surname>
        <affiliation>
          <address><email>mkp@mkp.net</email></address>
        </affiliation>
      </author>
    </authorgroup>
    <copyright>
      <year>1998, 1999</year> <holder>Martin K. Petersen</holder>
    </copyright>

    <legalnotice>
      <para>
	This documentation is free software; you can redistribute it
	and/or modify it under the terms of the GNU General Public
	License as published by the Free Software Foundation; either
	version 2 of the License, or (at your option) any later
	version.
      </para>
      
      <para>
        This program is distributed in the hope that it will be
        useful, but WITHOUT ANY WARRANTY; without even the implied
        warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR
        PURPOSE.  See the GNU General Public License for more details.
      </para>

      <para>
        You should have received a copy of the GNU General Public
        License along with this program; if not, write to the Free
        Software Foundation, Inc., 59 Temple Place, Suite 330, Boston,
        MA 02111-1307 USA
      </para>
      
      <para>
        For more details see the file COPYING in the source
        distribution of GDM.
      </para>
    </legalnotice>
  </bookinfo>

  <toc></toc>

  <preface>
    <title>Terms and conventions used in this book</title>

    <para>
      GDM - Gnome Display Manager. Used to describe the software
      package as a whole.
    </para>

    <para>
      gdm - The Gnome Display Manager daemon (<filename /gdm/).
    </para>

    <para>
      Greeter - The graphical login window (<filename /gdmlogin/).
    </para>

    <para>
      Chooser - The host chooser which appears on remote displays
      sending INDIRECT queries (<filename /gdmchooser/).
    </para>

    <para>
      Paths without a leading '/' are relative to the installation
      prefix. I.e. <filename>share/pixmaps/</filename> refers to
      <filename>/usr/share/pixmaps</filename> if GDM was configured
      with <filename>--prefix=/usr</filename>.
    </para>

  </preface>

  <chapter id="intro">
    <title>Overview</title>

    <sect1>
      <title>
	Introduction
      </title>

      <para> 
	GDM is a replacement for XDM, the X Display Manager. Unlike its
	competitors (X3DM, KDM, WDM) GDM was written from scratch and
	does not contain any original XDM / X Consortium code. 
      </para>
    </sect1>

    <sect1 id="daemonov">
      <title>The GDM Daemon</title>
      
      <para> 
	GDM was written with simplicity and security in mind. The
	overall design concept is this: 
      </para>
      
      <para> 
	Upon startup the <filename>gdm</filename> daemon parses its config file
	<filename>gdm.conf</filename>.  For each of the local displays <filename /gdm/
	forks an Xserver and a slave process. The main <filename /gdm/ process
	will then listen to XDMCP requests from remote displays and
	monitor the local display sessions.
      </para>
      
      <para> 
	The <filename /gdm/ slave process opens the display and starts
	<filename>gdmlogin</filename>, the graphical login
	program. <filename>gdmlogin</filename> runs as a dedicated
	user and communicates asynchronously with the slave process
	through a pipe.
      </para>
      
      <para> 
	GDM relies heavily on the presence of PAM, Pluggable
	Authentication Modules, but supports regular crypt() 
	and shadow passwords on legacy systems.
      </para>

      <para>
	Remote displays can connect to the XDMCP port on the GDM
	host. <filename /gdm/ will grant access to hosts specified in
	the gdm service section in your TCP Wrappers configuration
	file. GDM does not support remote display access control on
	systems without TCP Wrappers. XDMCP support can be turned off
	completely, however.
      </para>

      <para>
	GDM includes several measures making it more resistant to
	denial of service attacks on the XDMCP service. A lot of the
	protocol parameters, handshaking timeouts etc. can be fine
	tuned. The defaults should work for most systems, however.
	Don't change them unless you know what you're doing.
      </para>

      <para>
	In general GDM is very reluctant regarding reading/writing of
	user files. For instance it refuses to touch anything but
	regular files.  Links, sockets and devices are ignored.  The
	value of the RelaxPermissions parameter determines whether GDM
	should accept files writable by the user's group or others.
	These are ignored by default.
      </para>

      <para>
	All operations on user files are done with the effective
	userid of the user. If the sanity check fails on the user's
	<filename /.Xauthority/ file, a fallback cookie is created in
	<filename>/tmp</filename>.
      </para>

      <para>
	Finally, the sysadmin can specify the maximum file size GDM
	should accept, and, if the face browser is enabled, a tunable
	maximum icon size is also enforced.  On large systems it is
	still advised to turn off the face browser for performance
	reasons. Looking up icons in homedirs, scaling and rendering
	face icons can take quite a long time. YMMV.
      </para>
    </sect1>

    <sect1>
      <title>
	XDMCP
      </title>

      <para>
	GDM also supports the X Display Manager Protocol (XDMCP) for
	managing remote displays.
      </para>

      <para>
	GDM listens to UDP port 177 and will repond to QUERY and
	BROADCAST_QUERY requests by sending a WILLING packet to the
	originator.
      </para>

      <para>
	GDM can also be configured to honor INDIRECT queries and
	present a host chooser to the remote display. GDM will
	remember the user's choice and forward subsequent requests to
	the chosen manager.
      </para>

      <para>
	GDM only supports the MIT-MAGIC-COOKIE-1 authentication
	system.  Little is gained from the other schemes, and no
	effort has been made to implement them so far.
      </para>

      <para>
	Since it is fairly easy to do denial of service attacks on the
	XDMCP service, GDM incorporates a few features to guard
	against attacks. Please read the XDMCP reference section below
	for more information.
      </para>

      <para>
	Even though GDM tries to outsmart potential attackers, it is
	still adviced that you block UDP port 177 on your firewall
	unless you really need it. GDM guards against DoS attacks, but
	the X protocol is still inherently insecure and should only be
	used in controlled environments.
      </para>

      <para>
	Even though your display is protected by cookies the XEvents
	and thus the keystrokes typed when entering passwords will
	still go over the wire in clear text. It is trivial to capture
	these. You should also be aware that cookies, if placed on an
	NFS mounted directory, are prone to eavesdropping too.
      </para>

    </sect1>

    <sect1>
      <title>The Greeter</title>

      <para>
	The greeter is the graphical user interface that is presented
	to the user. The greeter contains a menu at the top, an
	optional face browser, an optional logo and a text entry
	widget.
      </para>

      <sect2>
	<title>
	  Text entry
	</title>

	<para>
	  The text entry field is used for entering logins, passwords,
	  passphrases etc. <filename /gdmlogin/ is controlled by the
	  underlying daemon and is basically stateless. The daemon
	  controls the greeter through a simple protocol where it can
	  ask the greeter for a text string with echo turned on or
	  off. Similarly, the daemon can change the label above the
	  text entry widget to correspond to the value the
	  authentication system wants the user to enter.
	</para>

      </sect2>

      <sect2>
	<title>
	  The Menu
	</title>

	<para>
	  The menu bar in the top of the greeter enables the user to
	  select the requested session type/desktop environment,
	  select an appropriate locale/language and optionally
	  shutdown/reboot the machine. The greeter window can also be
	  iconified to make room for other applications on the login
	  screen.
	</para>

      </sect2>

      <sect2>
	<title>
	  The face browser
	</title>

	<para>
	  The greeter provides a face browser containing icons for all
	  the users on a system. The icons can be installed globally
	  by the sysadmin or in the users' home directories.
	</para>
	
	<para>
	  The face browser makes a few assumptions about your
	  environment. First of all, the greeter runs under a
	  dedicated userid, and therefore any face icons located in
	  user directories must be readable to the gdm user. I.e. all
	  home- and <filename>~/.gnome</filename> directories must be
	  made readable and executable to the ``other'' group on the
	  system.
	</para>

	<para>
	  Similarly, face icons placed in the global face directory
	  must be readable to the gdm user.
	</para>

	<para>
	  Please note that loading and scaling face icons located in
	  user home directories can be a very time consuming task.
	  Especially on large systems or systems running NIS. The
	  browser feature is only intended for systems with relatively
	  few users.
	</para>

	<para>
	  To filter out unwanted user names in the browser, an exclude
	  option is implemented. The greeter will automatically ignore
	  usernames listed in the <filename /Exclude/ statement in the
	  config file.
	</para>

	<para>
	  When the browser is turned on, valid usernames on the
	  machine are inherently exposed to a potential intruder. If
	  your system is connected directly to the Internet, this
	  might be a bad idea.
	</para>

      </sect2>

      <sect2>
	<title>
	  The Logo
	</title>

	<para>
	  The greeter can optionally display a logo in the login
	  window. The image must be in a format readable to the Imlib
	  library (GIF, JPG, PNG, TIFF, XPM and possibly others), and
	  it must be readable to the gdm user. See the <filename
	  /Logo/ option in the reference section below for detauls.
	</para>

      </sect2>

    </sect1>

  </chapter>

  <chapter id="Configuration">
    <title>The Configuration Directory</title>

    <para> 
      The configuration files for GDM are located in the
      <filename>etc/gdm/</filename> directory.
    </para>

    <para>
      This is a listing of the config directory contents:
    </para>

    <screen>
	Init/
	PostSession/
	PreSession/
	Sessions/
	gdm.conf
    </screen>

    <para> 
      <filename>gdm.conf</filename> is the main GDM configuration file. The
      options will be described later in this chapter.
    </para>

    <para>
      <filename /gdm.conf/ is configuration file for both <filename
      /gdm/, <filename /gdmlogin/, and <filename /gdmchooser/ since a
      lot of parameters overlap.
    </para>

    <para> 
      The remaining configuration is done by dropping scripts in the
      subdirectories of the <filename>etc/gdm</filename> folder. This
      approach makes it easy for package management systems to install
      window managers and different session types without requiring
      the sysadmin to edit files.
    </para>

    <sect1>
      <title>The Script Directories</title>
      
      <para>
	In this section we will explain the <filename /Init/,
	<filename /PreRoot/ and <filename /PostRoot/ directories as
	they are very similar.
      </para>

      <para>
	When the X server has been successfully started, GDM will try
	to run the script called
	<filename>Init/&lt;displayname&gt;</filename>. I.e. <filename>Init/:0</filename>
	for the first local display.  If this file is not found, GDM
	will attempt to to run <filename>Init/Default</filename>. The
	script will be run as root and GDM blocks until it
	terminates. Use the <filename>Init/*</filename> script for
	programs that are supposed to run alongside with the GDM login
	window. xconsole for instance.  Commands to set the background
	etc. goes in this file too.
      </para>

      <para> 
	It is up to the sysadmin to decide whether clients started by
	the Init script should be killed before starting the user
	session. This is controlled with the KillInitClients option in
	<filename>gdm.conf</filename>.
      </para>

      <para>
	When the user has been successfully authenticated, GDM tries
	to run the PreSession script. Similar to the Init-scripts,
	<filename>PreSession/&lt;displayname&gt;</filename> will be
	executed, if this file doesn't exist, GDM will attempt to run
	<filename>PreSession/Default</filename>. The script will be
	run as root and GDM blocks until it terminates. Use this
	script for local session management or accounting stuff. The
	$USER environment variable contains the login of the
	authenticated user. The script should return 0 on success. Any
	other value will cause GDM to terminate the current login
	process.
      </para>

      <para>
	Then the session script is run. Session scripts are located in
	the <filename>etc/gdm/Session</filename> directory. Which one
	GDM runs, depends on the session the user chose in the
	Sessions-menu in the greeter. If no session is selected and
	the user has no last session stored in his
	<filename>~/.gnome/gdm</filename> file, the system will choose
	or first script found or -- if
	<filename>Sessions/Default</filename> exists -- this will be
	run. For instance you can create a symlink from
	<filename>Gnome</filename> to <filename>Default</filename> to
	make Gnome the default desktop environment.
      </para>

      <para> 
	When the user terminates his session, the PostSession script
	will be run. Operation is similar to Init and PreSession. That
	is, GDM will attempt to execute the script
	<filename>PostSession/&lt;displayname&gt;</filename> and if
	that doesn't exist <filename>PostSession/Default</filename>
	will be run. Again the script will be run with root
	priviledges, the slave daemon will block and the $USER
	environment variable will contain the name of the user who
	just logged out.
      </para>

      <para>
	Note that the PostSession script will be run even when the
	display fails to respond due to an I/O error or similar. Thus,
	there is no guarantee that X applications will work during
	script execution.
      </para>

      <para> 
	Neither of the Init, PreSession or PostSession scripts are
	necessary and can be left out. At least one session script is
	required for proper operation.
      </para>

    </sect1>

    <sect1>
      <title>The Configuration File - <filename>gdm.conf</filename></title>
      
      <para>
	The daemon and the accompanying utilities share a common
	configuration file: <filename>etc/gdm/gdm.conf</filename>.
      </para>

      <para>
	The configuration file is divided into sections each
	containing variables that define the behaviour for a specific
	part of the GDM suite.
      </para>

      <para>
	<filename>gdm.conf</filename> follows the standard GNOME configuration
	file syntax. Keywords in brackets define sections, strings
	before an equal sign (=) are variables and the data after
	equal sign represents their value.
      </para>

      <para>
	In general, 0 represents disable and 1 represents enable for
	boolean configuration options.
      </para>

      <sect2>
	<title>Daemon Configuration</title>

	<variablelist>
	  <title>[daemon]</title>
	  
	  <varlistentry>
	    <term>Chooser</term>
	    <listitem>
	      <synopsis>Chooser=bin/gdmchooser --disable-sound</synopsis>
	      <para>
		Full path and name of the chooser executable followed by optional arguments.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>DefaultPath</term>
	    <listitem>
	      <synopsis>DefaultPath=/bin:/usr/bin:/usr/bin/X11:/usr/local/bin</synopsis>
	      <para>
		Specifies the path which will be set in the user's session.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>DisplayInitDir</term>
	    <listitem>
	      <synopsis>DisplayInitDir=etc/gdm/Init</synopsis>
	      <para>
		Directory containing the display init scripts. See the
		``Script Directories'' section for more info.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>Greeter</term>
	    <listitem>
	      <synopsis>Greeter=bin/gdmlogin --disable-sound</synopsis>
	      <para>
		Full path and name of the greeter executable followed by optional arguments.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>Group</term>
	    <listitem>
	      <synopsis>Group=gdm</synopsis>
	      <para>
		The group id under which
		<filename>gdmlogin</filename>/<filename>gdmchooser</filename>
		are run.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>HaltCommand</term>
	    <listitem>
	      <synopsis>HaltCommand=/sbin/shutdown -h now</synopsis>
	      <para>
		Full path and arguments to command to be executed when
		user selects Halt from the System menu.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>KillInitClients</term>
	    <listitem>
	      <synopsis>KillInitClients=1</synopsis>
	      <para>
		Determines whether GDM should kill X clients started by
		the init scripts when the user logs in.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>LogDir</term>
	    <listitem>
	      <synopsis>LogDir=var/gdm</synopsis>
	      <para>
		Directory containing the log files for the individual
		displays.  By default this is the same as the
		ServAuthDir.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>PidFile</term>
	    <listitem>
	      <synopsis>PidFile=var/run/gdm.pid</synopsis>
	      <para>
		Name of the file containing the <filename>gdm</filename>
		process id.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>PostSessionScriptDir</term>
	    <listitem>
	      <synopsis>PostSessionScriptDir=etc/gdm/PostSession</synopsis>
	      <para>
		Directory containing the scripts run after the user logs
		out.  See the ``Script Directories'' section for more
		info.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>PreSessionScriptDir</term>
	    <listitem>
	      <synopsis>PreSessionScriptDir=etc/gdm/PreSession</synopsis>
	      <para>
		Directory containing the scripts run before the user
		logs in.  See the ``Script Directories'' section for
		more info.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>RebootCommand</term>
	    <listitem>
	      <synopsis>RebootCommand=/sbin/shutdown -r now</synopsis>
	      <para>
		Full path and optional arguments to the program to be
		executed when user selects Reboot from the System menu.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>RootPath</term>
	    <listitem>
	      <synopsis>RootPath=/sbin:/usr/sbin:/bin:/usr/bin:/usr/bin/X11:/usr/local/bin</synopsis>
	      <para>
		Specifies the path which will be set in the root's
		session and the {Init,PreSession,PostSession} scripts
		executed by GDM.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>ServAuthDir</term>
	    <listitem>
	      <synopsis>ServAuthDir=/var/gdm</synopsis>
	      <para>
		Directory containing the X authentication files for the
		individual displays.  Should be owned by
		<filename>gdm.gdm</filename> with permissions 750.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>SessionDir</term>
	    <listitem>
	      <synopsis>SessionDir=etc/gdm/Sessions</synopsis>
	      <para>
		Directory containing the scripts for all session types
		available on the system.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>User</term>
	    <listitem>
	      <synopsis>User=gdm</synopsis>
	      <para>
		The username under which <filename>gdmlogin</filename> /
		<filename>gdmchooser</filename> are run.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>UserAuthDir</term>
	    <listitem>
	      <synopsis>UserAuthDir=</synopsis>
	      <para>
		The directory where user's
		<filename>.Xauthority</filename> file should be
		saved. When nothing is specfied the user's home
		directory is used.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>UserAuthFBDir</term>
	    <listitem>
	      <synopsis>UserAuthFBDir=/tmp</synopsis>
	      <para>
		If GDM fails to update the user's
		<filename>.Xauthority</filename> file a
		fallback cookie is created in this directory.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>UserAuthFile</term>
	    <listitem>
	      <synopsis>UserAuthFile=.Xauthority</synopsis>
	      <para>
		Name of the file used for storing user cookies.  
	      </para>
	    </listitem>
	  </varlistentry>
	</variablelist>
	
      </sect2>

      <sect2>
	<title>Security Options</title>
	
	<variablelist>
	  <title>[security]</title>
	  
	  <varlistentry>
	    <term>AllowRoot</term>
	    <listitem>
	      <synopsis>AllowRoot=0</synopsis>
	      <para>
		Graphical root logins are disallowed by default.  Set
		this value to 1 to enable priviledged user logins.
	      </para>
	      <para>
		On systems that support PAM, this parameter is
		ignored. It's up to the PAM libraries to determine
		whether the user is on a local display or not.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>RelaxPermissions</term>
	    <listitem>
	      <synopsis>RelaxPermissions=0</synopsis>
	      <para>
		By default GDM ignores files and directories writable to
		other users than the owner. 
	      </para> 
	      
	      <para> 
		Changing the value of RelaxPermissions makes it
		possible to alter this behaviour:
	      </para>
	      
	      <para>
        	0 - Paranoia option. Only accepts user owned files and directories.
	      </para>
	      <para>
        	1 - Allow group writable files and directories.
	      </para>
	      <para>
        	2 - Allow world writable files and directories.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>RetryDelay</term>
	    <listitem>
	      <synopsis>RetryDelay=3</synopsis>
	      <para>
		The number of seconds GDM should wait before
		reactivating the entry field after a failed login.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>UserMaxFile</term>
	    <listitem>
	      <synopsis>UserMaxFile=65536</synopsis>
	      <para>
		GDM will refuse to read/write files bigger than this number
		(specified in bytes).
	      </para>
	      
	      <para>
        	In addition to the size check both
        	<filename>gdm</filename> and
        	<filename>gdmlogin</filename> are extremely picky
        	about accessing files in user directories. Neither
        	will follow symlinks and they can optionally refuse to
        	read files and directories writable by other than the
        	owner. See the RelaxPermissions option for more info.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>VerboseAuth</term>
	    <listitem>
	      <synopsis>VerboseAuth=0</synopsis>
	      <para>
		Specifies whether GDM should print authentication errors
		in the message field in the greeter. 
	      </para>
	      
	      <para>
		Depending on your system setup, usernames might be 
		exposed when this option is on.
	      </para>
	    </listitem>
	  </varlistentry>
	</variablelist>
	
      </sect2>

      <sect2>
	<title>XDCMP Support</title>

	<variablelist>
	  <title>[xdmcp]</title>
	  
	  <varlistentry>
	    <term>Enable</term>
	    <listitem>
	      <synopsis>Enable=0</synopsis>
	      <para>
		Setting this to 1 enables XDMCP support allowing remote displays/X
		terminals to be managed by GDM.
	      </para>
	      
	      <para>
		<filename>gdm</filename> listens for requests on UDP
		port 177. See the Port option for more information.
	      </para>
	      
	      <para>
		If GDM is compiled to support it, access from remote displays
		can be controlled using the TCP Wrappers library. The service name is 
		<filename>gdm</filename>
	      </para>
	      
	      <para>
		You should add 
	      </para>
	      
	      <screen>
		gdm:	.my.domain
	      </screen>
	      
	      <para>
		to your <filename>/etc/hosts.allow</filename>. See the
		<filename>hosts_access(5)</filename> man page for details.
	      </para>
	      
	      <para>
		Please note that XDMCP is not a particularly secure protocol
		and that it is a good idea to block UDP port 177 on your
		firewall unless you really need it.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>HonorIndirect</term>
	    <listitem>
	      <synopsis>HonorIndirect=1</synopsis>
	      <para>
		Enables XDMCP INDIRECT choosing (i.e. remote execution
		of <filename>gdmchooser</filename>) for X-terminals
		which don't supply their own display browser.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>MaxPending</term>
	    <listitem>
	      <synopsis>MaxPending=4</synopsis>
	      <para>
		To avoid denial of service attacks, GDM has fixed size
		queue of pending connections. Only MaxPending displays
		can start at the same time.
	      </para>
	      
	      <para>
		Please note that this parameter does *not* limit the
		number of remote displays which can be managed. It only
		limits the number of displays initiating a connection
		simultaneously.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>MaxPendingIndirect</term>
	    <listitem>
	      <synopsis>MaxPendingIndirect=4</synopsis>
	      <para>
		GDM will only provide MaxPendingIndirect displays with
		host choosers simultaneously.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>MaxSessions</term>
	    <listitem>
	      <synopsis>MaxSessions=16</synopsis>
	      <para>
		Determines the maximum number of remote display
		connections which will be managed
		simultaneously. I.e. the total number of remote displays
		that can use your host.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>MaxWait</term>
	    <listitem>
	      <synopsis>MaxWait=30</synopsis>
	      <para>
		When GDM is ready to manage a display an ACCEPT packet
		is sent to it containing a unique session id which will
		be used in future XDMCP conversations.
	      </para>
	      
	      <para>
		GDM will then place the session id in the pending queue
		waiting for the display to respond with a MANAGE request.
	      </para>
	      
	      <para>
		If no response is received within MaxWait seconds, GDM
		will declare the display dead and erase it from the pending
		queue freeing up the slot for other displays.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>MaxWaitIndirect</term>
	    <listitem>
	      <synopsis>MaxWaitIndirect=30</synopsis>
	      <para>
		The MaxWaitIndirect parameter determines the maximum
		number of seconds between the time where a display
		requests a chooser and completion of protocol
		negotiation. If the timeout is exceeded, GDM will
		remove the display from the pending list freeing up
		the slot for other displays.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>Port</term>
	    <listitem>
	      <synopsis>Port=177</synopsis>
	      <para>
		The UDP port number <filename>gdm</filename> should
		listen to for XDMCP requests. Don't change this unless
		you know what you're doing.
	      </para>
	    </listitem>
	  </varlistentry>
	</variablelist>
	
      </sect2>

      <sect2>
	<title>Common GUI Configuration Options</title>

	<variablelist>
	  <title>[gui]</title>
	  
	  <varlistentry>
	    <term>Gtkrc</term>
	    <listitem>
	      <synopsis>Gtkrc=</synopsis>
	      <para>
		Path to a <filename>gtkrc</filename> containing the
		theme for use in <filename>gdmlogin</filename> /
		<filename>gdmchooser</filename>.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>MaxIconWidth</term>
	    <listitem>
	      <synopsis>MaxIconWidth=128</synopsis>
	      <para>
		Specifies the maximum icon width (in pixels) that the
		face browser will display. Icons larger than this will
		be scaled.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>MaxIconHeight</term>
	    <listitem>
	      <synopsis>MaxIconHeight=128</synopsis>
	      <para>
		Specifies the maximum icon height (in pixels) that the
		face browser will display. Icons larger than this will
		be scaled.
	      </para>
	    </listitem>
	  </varlistentry>
	</variablelist>
	
      </sect2>
	
      <sect2>

	<title>Greeter Configuration</title>

	<variablelist>
	  <title>[greeter]</title>
	  
	  <varlistentry>
	    <term>Browser</term>
	    <listitem>
	      <synopsis>Browser=0</synopsis>
	      <para>
		Set to 1 to enable the face browser. See the ``Greeter''
		section for more information on the face browser.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>DefaultFace</term>
	    <listitem>
	      <synopsis>DefaultFace=share/pixmaps/nophoto.png</synopsis>
	      <para>
		Default icon file for users without a personal picture
		in <filename>~/gnome/photo</filename>. The image must be
		in an Imlib supported format and the file must be
		readable for the gdm user.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>DefaultLocale</term>
	    <listitem>
	      <synopsis>DefaultLocale=english</synopsis>
	      <para>
		This language is used for the session unless nothing is
		specified in <filename>~user/.gnome/gdm</filename> and
		the user didn't select a language in the Locale menu in
		the greeter.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>Exclude</term>
	    <listitem>
	      <synopsis>Exclude=bin,daemon,adm,lp,sync,shutdown,halt,mail,...</synopsis>
	      <para>
		Comma-separated list of usernames to exclude from the
		face browser. The excluded users will still be able to
		log in.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>Font</term>
	    <listitem>
	      <synopsis>Font=-adobe-helvetica-bold-r-normal-*-*-180-*-*-*-*-*-*</synopsis>
	      <para>
		Font to use for the welcome message in the greeter.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>GlobalFaceDir</term>
	    <listitem>
	      <synopsis>GlobalFaceDir=share/faces/</synopsis>
	      <para>
		Systemwide directory for face files. The sysadmin can
		place icons for users here without touching their
		homedirs. Faces are named after their users' logins.
	      </para>
	      
	      <para>
		I.e. <filename>&lt;GlobalFaceDir&gt;/johndoe</filename>
		would contain the face icon for the user ``johndoe''. No
		image format extension should be specified. 
	      </para>
	      
	      <para>
		The face images must be stored in Imlib supported formats and
		they must be readable for the GDM user.
	      </para>
	      
	      <para>
		A user's own icon file will always take precedence over the sysadmin
		provided one.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>Icon</term>
	    <listitem>
	      <synopsis>Icon=share/pixmaps/gdm.xpm</synopsis>
	      <para>
		Icon to use for <filename>gdmlogin</filename> when it's
		in the iconified state. The image must be in an Imlib
		supported format and it must be readable for the GDM
		user. If no file is specified the iconify feature is
		disabled.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>LocaleFile</term>
	    <listitem>
	      <synopsis>LocaleFile=etc/gdm/locale.alias</synopsis>
	      <para>
		File in GNU locale format with entries for all supported
		languages on the system.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>Logo</term>
	    <listitem>
	      <synopsis>Logo=share/pixmaps/gnome-logo-large.png</synopsis>
	      <para>
		Image file to display in the logo box. The file must be
		in an Imlib supported format and it must be readable by
		the GDM user. If no file is specified the logo feature
		is disabled.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>Quiver</term>
	    <listitem>
	      <synopsis>Quiver=1</synopsis>
	      <para>
		Controls whether <filename>gdmlogin</filename> should
		shake the display when an incorrect username/password is
		entered.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>SystemMenu</term>
	    <listitem>
	      <synopsis>SystemMenu=0</synopsis>
	      <para>
		Turns the Shutdown/Halt menu on/off.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>Welcome</term>
	    <listitem>
	      <synopsis>Welcome=Welcome to %n</synopsis>
	      <para>
		Controls which text to display next to the logo image in the
		greeter. The following control chars are supported:
	      </para>
	      
	      <para>
		%%	the `%' character
	      </para>
	      
	      <para>
		%d	display's hostname
	      </para>
	      
	      <para>
		%h	Fully qualified hostname
	      </para>

	      <para>
		%m	machine (processor type)
	      </para>

	      <para>
		%n	Nodename (i.e. hostname without .domain)
	      </para>
	      
	      <para>
		%r	release (OS version)
	      </para>
	      
	      <para>
		%s	sysname (i.e. OS)
	      </para>
	      	      
	    </listitem>
	  </varlistentry>
	</variablelist>
	
      </sect2>

      <sect2>

	<title>XDCMP Chooser Options</title>

	<variablelist>
	  <title>[chooser]</title>
	  
	  <varlistentry>
	    <term>DefaultHostImage</term>
	    <listitem>
	      <synopsis>DefaultHostImage=share/pixmaps/nohost.png</synopsis>
	      <para>
		File name for the default host icon. This image will be
		displayed if no icon is specified for a given host. The
		file must be in an Imlib supported format and it must be
		readable for the GDM user.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>HostImageDir</term>
	    <listitem>
	      <synopsis>HostImageDir=share/hosts</synopsis>
	      <para>
		Repository for host icon files. The sysadmin can place
		icons for remote hosts here and they will appear in
		<filename>gdmchooser</filename>.
	      </para>
	      
	      <para>
		The file name must match the fully qualified name (FQDN) for the host.
		The icons must be stored in Imlib supported formats and they must be
		readable to the gdm user.
	      </para>
	      
	    </listitem>
	  </varlistentry>
	  
	  <varlistentry>
	    <term>ScanTime</term>
	    <listitem>
	      <synopsis>ScanTime=3</synopsis>
	      <para>
		Specifies how many seconds the chooser should wait for
		replies to its BROADCAST_QUERY.
	      </para>
	    </listitem>
	  </varlistentry>
	</variablelist>
	
      </sect2>

      <sect2>

	<title>Local X Server Configuration</title>
	
	<variablelist>
	  <title>[servers]</title>
	  
	  <varlistentry>
	    <term>0</term>
	    <listitem>
	      <synopsis>0=/usr/bin/X11/X</synopsis>
	      <para>
		Control section for local X servers. Each line indicates
		the local display number and the command that needs to
		be run to start the X server(s).
	      </para>
	      
	      <para>
		GDM will append "<filename>-auth
		  &lt;ServAuthDir&gt;/:n.Xauth :n</filename>", where n is
		the display number.
	      </para>
	    </listitem>
	  </varlistentry>
	  
	</variablelist>

      </sect2>
	
    </sect1>
    
  </chapter>
  
</book>

<!-- Keep this comment at the end of the file
Local variables:
mode: sgml
sgml-omittag:t
sgml-shorttag:t
sgml-minimize-attributes:nil
sgml-always-quote-attributes:t
sgml-indent-step:2
sgml-indent-data:t
sgml-parent-document:nil
sgml-exposed-tags:nil
sgml-local-catalogs:nil
sgml-local-ecat-files:nil
End:
-->               
