display manager - lightdm, gdm3, sddm or no display manager (startx)

Whonix 15 was using lightdm. It was removed due to autologin heisenbug. [1] [2] [3]

Therefore Whonix 16 is using gdm3. It is also a good choice because it supports wayland (and fits with Gnome, which Whonix might be ported to, depending on many things such as feasibility, resource use, please use a dedicated forum thread (none might exist yet, see [4]).


[1] autologin not work sometimes · Issue #210 · canonical/lightdm · GitHub

[2] autologin is not working every time · Issue #191 · canonical/lightdm · GitHub

[3] Heisenbug - Wikipedia

[4] Search results for 'wayland' - Whonix Forum

1 Like

If this is doable during this release cycle, then it would exceed any other benefit of switching away including reduced resource usage.

1 Like

Dunno. I’ll know when I get to it. Depends on how many / any issues caused by wayland.

1 Like
1 Like
1 Like

display manager requirements:

  • in packages.debian.org
  • no dependency hell
  • wayland support
  • autologin supported without heisenbug
  • no hardcoding of desktop environment required in config for autologin

Not easy to find…

gdm3:

sddm:

  • in packages.debian.org
  • no dependency hell
  • wayland support
  • autologin supported
  • hardcoded Session=xfce config required (would be a technical debt making porting to other desktop environments harder)

lightdm:

1 Like

Debian bug report:
lightdm-autologin-greeter: out-comment defunct autologin-user=AUTOLOGIN-USER-NOT-CONFIGURED in /etc/lightdm/lightdm.conf.d/lightdm-autologin-greeter.conf

1 Like

Yet another option might be not using any display manager and instead use startx (or its wayland equivalent).

For that purpose RAM Adjusted Desktop Starter - Kicksecure (rads) could be modified.
(Whonix is based on Kicksecure.)
If no display manager is installed and if there is enough RAM and if startx is available, start it.
(Configurable.)

How about Whonix-Host?
(Would equally apply to Kicksecure host.)

  • Pre-configured style: Should have display manager and no default autologin? Also for logon password at every boot required.
  • Minimal style: autologin using startx by default. Display manager installation, logon password setup should be left to the user?

Display manager login password has limited use anyhow when already using Full Disk Encryption (FDE)Protection against Physical Attacks.

1 Like

Might be fixed in Debian bookworm or bookworm + 1 as per Autologin in X11 does not work if session name is absolute path · Issue #1607 · sddm/sddm · GitHub.

Fixed in Debian bookworm.

Automatically rebooted a VM a few hundred times and no autologin heisenbug so far.

Whonix 15 was using gdm3.
Whonix 16 will switch back to lightdm.

1 Like

add accountservice to kicksecure-desktop-environment-essential-xfce

fixes:

localhost lightdm[911]: Error getting user list from org.freedesktop.Accounts: GDBus.Error:org.freedesktop.DBus.Error.ServiceUnknown: The name org.freedesktop.Accounts was not provided by any .service files

package lightdm Suggests: accountservice

add `accountservice` to `kicksecure-desktop-environment-essential-xfce` · Kicksecure/kicksecure-meta-packages@1f544bf · GitHub

For the Trixie port, we may want to consider a combination of greetd and an acceptable greeter such as wlgreet. greetd functions in a way somewhat similar to lightdm (separate display manager and greeter processes), but it’s quite a bit simpler, makes it very easy to use Wayland for the greeter (and for launched sessions), and works pretty well with read-only root filesystems (so far it doesn’t seem to need write access to anything in the root filesystem when used with wlgreet). There is a Qt-based greeter available for greetd as well, but unfortunately it is not available in Debian’s archives at the moment.

Compared to other popular greeters:

  • LightDM: Can use Wayland, but isn’t Qt-based if using Wayland via elephant-greeter. Seems to require write access to directories on the root filesystem.
  • SDDM: Can use Wayland, Qt-based. Directory requirements unknown. Whether this will be maintained in the future is unknown, since KDE has decided to make their own display manager to avoid needing SDDM due to SDDM’s limited (for KDE) feature set.
  • gdm: Can use Wayland. Isn’t Qt-based. Requires tons of GNOME stuff. Directory write access requirements unknown.

So far my only gripes with greetd (after having played with it briefly) are:

  • At least when used with wlgreet, it’s difficult to switch desktops. LightDM provided a drop-down box you could click to select your session and integrated with the xsessions and wayland-sessions mechanisms. greetd + wlgreet has a command hardcoded in a file that is executed as the authenticated user upon login, and that’s it. That’s plenty enough to start a Wayland session, but it’s lacking for users who want multiple desktops.
    • This might actually be a plus, since it means it’s impossible for a user to accidentally try to log into a sysmaint session in user mode, or vice versa. Whatever the system is set up to allow the user to do on login, that’s what they’ll be able to do, and nothing else.
  • wlgreet is not exactly the best-looking login greeter I’ve ever seen. It has some theming options (not a whole lot at first glance), but out of the box it looks like this:

  • wlgreet insists on installing Sway as a dependency, since it is a Wayland application and needs a Wayland compositor to run. We aren’t using Sway, we’re using labwc, but Sway is a hard dependency of wlgreet in Debian. If this bugged us too much, we could in theory write our own greetd greeter, which could use labwc, be Qt-based (written in Python), and look nice. (greetd uses what appears to be a painfully simple IPC protocol for greeters - it’s just length-prefixed JSON strings with a few simple-looking commands and responses. Writing a Python+Qt client for this would probably be relatively easy.)
1 Like

We’ll consider that an advantage / acceptable limitation. And tell users on Other Desktop Environments about this and explain other display mangers can be used in that case.

Basic theming would suffice.

dummy-dependency sway”

1 Like

I should clarify: Not literally using dummy-dependency but probably instead adding a dummy dependency to kicksecure-meta-packages.

1 Like