5.3.1 Automatic Login and Passwordless Login

If you use KDE or GNOME desktop environment you can configure Auto Login for a certain user as well as Passwordless Login for all users. Auto login causes a user to become automatically logged in to the desktop environment on boot. This functionality can only be activated for one user at a time. Login without password allows all users to log in to the system after they have entered their username in the login manager.

WARNING: Security Risk

Enabling Auto Login or Passwordless Login on a machine that can be accessed by more than one person is a security risk. Without the need to authenticate, any user can gain access to your system and your data. If your system contains confidential data, do not use this functionality.

If you want to activate auto login or login without password, access these functions in the YaST User and Group Administration with Expert Options > Login Settings.

5.3.2 Enforcing Password Policies

On any system with multiple users, it is a good idea to enforce at least basic password security policies. Users should change their passwords regularly and use strong passwords that cannot easily be exploited. For local users, proceed as follows:

Configuring Password Settings

Open the YaST User and Group Administration dialog and select the Users tab.
Select the user for which to change the password options and click Edit.
Switch to the Password Settings tab.
To make the user change his password at next login, activate Force Password Change.
To enforce password rotation, set a Maximum Number of Days for the Same Password and a Minimum Number of Days for the Same Password.
To remind the user to change his password before it expires, set a number of Days before Password Expiration to Issue Warning.
To restrict the period of time the user can log in after his password has expired, change the value in Days after Password Expires with Usable Login.
You can also specify a certain expiration date for a password. Enter the Expiration Date in YYYY-MM-DD format.
For more information about the options and about the default values, click Help.
Apply your changes with OK.

5.3.3 Managing Encrypted Home Directories

To protect data in home directories against theft and hard disk removal, you can create encrypted home directories for users. These are encrypted with LUKS (Linux Unified Key Setup), which results in an image and an image key generated for the user. The image key is protected with the user's login password. When the user logs in to the system, the encrypted home directory is mounted and the contents are made available to the user.

NOTE: Fingerprint Reader Devices and Encrypted Home Directories

If you want to use a fingerprint reader device, you must not use encrypted home directories. Otherwise logging in will fail, because decrypting during login is not possible in combination with an active fingerprint reader device.

With YaST, you can create encrypted home directories for new or existing users. To encrypt or modify encrypted home directories of already existing users, you need to know the user's current login password. By default, all existing user data is copied to the new encrypted home directory, but it is not deleted from the unencrypted directory.

WARNING: Security Restrictions

Encrypting a user's home directory does not provide strong security from other users. If strong security is required, the system should not be physically shared.

Find background information about encrypted home directories and which actions to take for stronger security in Section 36.2, Using Encrypted Home Directories, (↑ Reference ).

Creating Encrypted Home Directories

Open the YaST User and Group Management dialog and click the Users tab.
To encrypt the home directory of an existing user, select the user and click Edit.

Otherwise, click Add to create a new user account and enter the appropriate user data on the first tab.
In the Details tab, activate Use Encrypted Home Directory. With Directory Size in MB, specify the size of the encrypted image file to be created for this user.
Apply your settings with OK.
Enter the user's current login password to proceed if YaST prompts for it.
Click Expert Options > Write Changes Now to save all changes without exiting the administration dialog. Or click Finish to close the administration dialog and to save the changes.

Modifying or Disabling Encrypted Home Directories

Of course, you can also disable the encryption of a home directory or change the size of the image file at any time.

Open the YaST User and Group Administration dialog in the Users view.
Select a user from the list and click Edit.
If you want to disable the encryption, switch to the Details tab and disable Use Encrypted Home Directory.

If you need to enlarge or reduce the size of the encrypted image file for this users, change the Directory Size in MB.
Apply your settings with OK.
Enter the user's current login password to proceed if YaST prompts for it.
Click Expert Options > Write Changes Now to save all changes without exiting the User and Group Administration dialog. Or click Finish to close the administration dialog and to save the changes.

5.3.4 Using Fingerprint Authentication

If your system includes a fingerprint reader you can use biometric authentication in addition to standard authentication via login and password. After registering their fingerprint, users can log in to the system either by swiping a finger on the fingerprint reader or by typing in a password.

Fingerprints can be registered with YaST. Find detailed information about configuration and use of fingerprint authentication in Section 32.0, Using the Fingerprint Reader, (↑ Reference ). For a list of supported devices, refer to https://reactivated.net/fprint/wiki/Supported_devices.

5.3.5 Managing Quotas

To prevent system capacities from being exhausted without notification, system administrators can set up quotas for users or groups. Quotas can be defined for one or more file systems and restrict the amount of disk space that can be used and the number of inodes (index notes) that can be created there. Inodes are data structures on a file system that store basic information about a regular file, directory, or other file system object. They store all attributes of a file system object (like user and group ownership, read, write, or execute permissions), except file name and contents.

openSUSE allows usage of soft and hard quotas. Soft quotas usually define a warning level at which users are informed they are nearing their limit, whereas hard quotas define the limit at which write requests are denied. Additionally, grace intervals can be defined that allow users or groups to temporarily violate their quotas by certain amounts.

Enabling Quota Support for a Partition

In order to configure quotas for certain users and groups, you need to enable quota support for the respective partition in the YaST Expert Partitioner first.

In YaST, select System > Partitioner and click Yes to proceed.
In the Expert Partitioner, select the partition for which to enable quotas and click Edit.
Click Fstab Options and activate Enable Quota Support. If the quota package is not already installed, it will be installed if you confirm the respective message with Yes.
Confirm your changes and leave the Expert Partitioner.

Setting Up Quotas for Users or Groups

Now you can define soft or hard quotas for specific users or groups and set time periods as grace intervals.

In the YaST User and Group Administration, select the user or the group you want to set the quotas for and click Edit.
On the Plug-Ins tab, select the quota entry and click Launch to open the Quota Configuration dialog.
From File System, select the partition to which the quota should apply.
Below Size Limits, restrict the amount of disk space. Enter the number of 1 KB blocks the user or group may have on this partition. Specify a Soft Limit and a Hard Limit value.
Additionally, you can restrict the number of inodes the user or group may have on the partition. Below Inodes Limits, enter a Soft Limit and Hard Limit.
You can only define grace intervals if the user or group has already exceeded the soft limit specified for size or inodes. Otherwise, the time-related input fields are not activated. Specify the time period for which the user or group is allowed to exceed the limits set above.
Confirm your settings with OK.
Click Expert Options > Write Changes Now to save all changes without exiting the User and Group Administration dialog. Or click Finish to close the administration dialog and to save the changes.

openSUSE also ships command line tools like repquota or warnquota with which system administrators can control the disk usage or send e-mail notifications to users exceeding their quota. With quota_nld, administrators can also forward kernel messages about exceeded quotas to D-BUS. For more information, refer to the repquota, the warnquota and the quota_nld man page (root password needed).

5.3 Additional Options for User Accounts