This option exists solely for the purpose of clean automatic upgrades. Do not change it, you may interfere with future upgrades and this could result in kdm failing to run.

List of displays (X-Servers) permanently managed by kdm. Displays with a hostname are foreign displays which are expected to be already running, the others are local displays for which kdm starts an own X-Server; see ServerCmd. Each display may belong to a display class; append it to the display name separated by an underscore. See the section called “Specifying permanent X-Servers” for the details.

The default is “:0”.

List of on-demand displays. See StaticServers for syntax.

Empty by default.

List of Virtual Terminals to allocate to X-Servers. For negative numbers the absolute value is used, and the VT will be allocated only if the kernel says it is free. If kdm exhausts this list, it will allocate free VTs greater than the absolute value of the last entry in this list. Currently Linux only.

Empty by default.

This option is for operating systems (OSs) with support for virtual terminals (VTs), by both kdm and the OSs itself. Currently this applies only to Linux.

When kdm switches to console mode, it starts monitoring all TTY lines listed here (without the leading /dev/). If none of them is active for some time, kdm switches back to the X login.

Empty by default.

The filename specified will be created to contain an ASCII representation of the process ID of the main kdm process; the PID will not be stored if the filename is empty.

Empty by default.

This option controls whether kdm uses file locking to keep multiple display managers from running onto each other.

The default is “true”.

This names a directory under which kdm stores X-Server authorization files while initializing the session. kdm expects the system to clean up this directory from stale files on reboot.

The authorization file to be used for a particular display can be specified with the AuthFile option in [X-*-Core].

The default is “/var/run/xauth”.

This boolean controls whether kdm automatically re-reads its configuration files if it finds them to have changed.

The default is “true”.

Additional environment variables kdm should pass on to all programs it runs. LD_LIBRARY_PATH and XCURSOR_THEME are good candidates; otherwise, it should not be necessary very often.

Empty by default.

If the system has no native entropy source like /dev/urandom (see RandomDevice) and no entropy daemon like EGD (see PrngdSocket and PrngdPort) is running, kdm will fall back to its own pseudo-random number generator that will, among other things, successively checksum parts of this file (which, obviously, should change frequently).

This option does not exist on Linux and various BSDs.

The default is “/dev/mem”.

If the system has no native entropy source like /dev/urandom (see RandomDevice), read random data from a Pseudo-Random Number Generator Daemon, like EGD (http://egd.sourceforge.net) via this UNIX domain socket.

This option does not exist on Linux and various BSDs.

Empty by default.

Same as PrngdSocket, only use a TCP socket on localhost.

The path to a character device which kdm should read random data from. Empty means to use the system's preferred entropy device if there is one.

This option does not exist on OpenBSD, as it uses the arc4_random function instead.

Empty by default.

The directory in which the command sockets should be created; make it empty to disable them.

The default is “/var/run/xdmctl”.

The group to which the global command socket should belong; can be either a name or a numerical ID.

The user the greeter should run as. Empty results in root. Consider the impact on LogSource when setting it.

Empty by default.

The directory in which kdm should store persistent working data; such data is, for example, the previous user that logged in on a particular display.

The default is “/var/lib/kdm”.

The directory in which kdm should store users' .dmrc files. This is only needed if the home directories are not readable before actually logging in (like with AFS).

Empty by default.

Whether kdm should listen to incoming XDMCP requests.

The default is “true”.

This indicates the UDP port number which kdm uses to listen for incoming XDMCP requests. Unless you need to debug the system, leave this with its default value.

The default is “177”.

XDM-AUTHENTICATION-1 style XDMCP authentication requires a private key to be shared between kdm and the terminal. This option specifies the file containing those values. Each entry in the file consists of a display name and the shared key.

Empty by default.

To prevent unauthorized XDMCP service and to allow forwarding of XDMCP IndirectQuery requests, this file contains a database of hostnames which are either allowed direct access to this machine, or have a list of hosts to which queries should be forwarded to. The format of this file is described in the section called “XDMCP access control”.

The default is “${kde_confdir}/kdm/Xaccess”.

Number of seconds to wait for the display to respond after the user has selected a host from the chooser. If the display sends an XDMCP IndirectQuery within this time, the request is forwarded to the chosen host; otherwise, it is assumed to be from a new session and the chooser is offered again.

The default is “15”.

When computing the display name for XDMCP clients, the name resolver will typically create a fully qualified host name for the terminal. As this is sometimes confusing, kdm will remove the domain name portion of the host name if it is the same as the domain name of the local host when this option is enabled.

The default is “true”.

Use the numeric IP address of the incoming connection on multihomed hosts instead of the host name. This is to avoid trying to connect on the wrong interface which might be down at this time.

The default is “false”.

This specifies a program which is run (as root) when an XDMCP DirectQuery or BroadcastQuery is received and this host is configured to offer XDMCP display management. The output of this program may be displayed in a chooser window. If no program is specified, the string “Willing to manage” is sent.

Empty by default.

The command (subject to word splitting) to run to halt/poweroff the system.

The default is something reasonable for the system on which kdm was built, like /sbin/shutdown -h now.

The command (subject to word splitting) to run to reboot the system.

The default is something reasonable for the system kdm on which was built, like /sbin/shutdown -r now.

Whether it is allowed to shut down the system via the global command socket.

The default is “false”.

Whether it is allowed to abort active sessions when shutting down the system via the global command socket.

This will have no effect unless AllowFifo is enabled.

The default is “true”.

The boot manager kdm should use for offering boot options in the shutdown dialog.

The default is “None”.

See OpenRepeat.

The default is “15”.

See OpenRepeat.

The default is “120”.

These options control the behavior of kdm when attempting to open a connection to an X-Server. OpenDelay is the length of the pause (in seconds) between successive attempts, OpenRepeat is the number of attempts to make and OpenTimeout is the amount of time to spend on a connection attempt. After OpenRepeat attempts have been made, or if OpenTimeout seconds elapse in any particular connection attempt, the start attempt is considered failed.

The default is “5”.

How many times kdm should attempt to start a foreign display listed in StaticServers before giving up and disabling it. Local displays are attempted only once, and XDMCP displays are retried indefinitely by the client (unless the option -once was given to the X-Server).

The default is “4”.

How many times kdm should attempt to start up a local X-Server. Starting up includes executing it and waiting for it to come up.

The default is “1”.

How many seconds kdm should wait for a local X-Server to come up.

The default is “30”.

The command line to start the X-Server, without display number and VT spec. Note that with some X-Servers (in particular, OpenSolaris') it is necessary to put most additional arguments into ServerArgsLocal and ServerArgsRemote even if they are the same for both. This string is subject to word splitting.

The default is something reasonable for the system on which kdm was built, like /usr/X11R6/bin/X.

Additional arguments for the X-Servers for local sessions. This string is subject to word splitting.

Empty by default.

Additional arguments for the X-Servers for remote sessions. This string is subject to word splitting.

Empty by default.

The VT the X-Server should run on. ServerVTs should be used instead of this option. Leave it zero to let kdm assign a VT automatically. Set it to -1 to avoid assigning a VT alltogether - this is required for setups with multiple physical consoles. Currently Linux only.

This option is for OSs without support for VTs, either by kdm or the OS itself. Currently this applies to all OSs but Linux.

When kdm switches to console mode, it starts monitoring this TTY line (specified without the leading /dev/) for activity. If the line is not used for some time, kdm switches back to the X login.

Empty by default.

The user the X-Server should run as. Empty results in root.

Empty by default.

See PingTimeout.

The default is “5”.

To discover when remote displays disappear, kdm regularly pings them. PingInterval specifies the time (in minutes) between the pings and PingTimeout specifies the maximum amount of time (in minutes) to wait for the terminal to respond to the request. If the terminal does not respond, the session is declared dead and terminated.

If you frequently use X terminals which can become isolated from the managing host, you may wish to increase the timeout. The only worry is that sessions will continue to exist after the terminal has been accidentally disabled.

The default is “5”.

Whether kdm should restart the local X-Server after session exit instead of resetting it. Use this if the X-Server leaks memory or crashes the system on reset attempts.

The default is “false”.

Controls whether kdm generates and uses authorization for local X-Server connections. For XDMCP displays the authorization requested by the display is used; foreign non-XDMCP displays do not support authorization at all.

The default is “true”.

If Authorize is true, use the authorization mechanisms listed herein. The MIT-MAGIC-COOKIE-1 authorization is always available; XDM-AUTHORIZATION-1, SUN-DES-1 and MIT-KERBEROS-5 might be available as well, depending on the build configuration.

The default is “DEF_AUTH_NAME”.

Some old X-Servers re-read the authorization file at X-Server reset time, instead of when checking the initial connection. As kdm generates the authorization information just before connecting to the display, an old X-Server would not get up-to-date authorization information. This option causes kdm to send SIGHUP to the X-Server after setting up the file, causing an additional X-Server reset to occur, during which time the new authorization information will be read.

The default is “false”.

This file is used to communicate the authorization data from kdm to the X-Server, using the -auth X-Server command line option. It should be kept in a directory which is not world-writable as it could easily be removed, disabling the authorization mechanism in the X-Server. If not specified, a random name is generated from AuthDir and the name of the display.

Empty by default.

This option specifies the name of the file to be loaded by xrdb as the resource database onto the root window of screen 0 of the display. KDE programs generally do not use X-resources, so this option is only needed if the Setup program needs some X-resources.

Empty by default.

The xrdb program to use to read the X-resources file specified in Recources. The command is subject to word splitting.

The default is “${x_bindir}/xrdb”.

This string is subject to word splitting. It specifies a program which is run (as root) before offering the greeter window. This may be used to change the appearance of the screen around the greeter window or to put up other windows (e.g., you may want to run xconsole here). Usually, a script named Xsetup is used here. See the section called “Setup program”.

Empty by default.

This string is subject to word splitting. It specifies a program which is run (as root) after the user authentication process succeeds. Usually, a script named Xstartup is used here. See the section called “Startup program”.

Empty by default.

This string is subject to word splitting. It specifies a program which is run (as root) after the session terminates. Usually, a script named Xreset is used here. See the section called “Reset program”.

Empty by default.

This string is subject to word splitting. It specifies the session program to be executed (as the user owning the session). Usually, a script named Xsession is used here. See the section called “Session program”.

The default is “${x_bindir}/xterm -ls -T”.

If the Session program fails to execute, kdm will fall back to this program. This program is executed with no arguments, but executes using the same environment variables as the session would have had (see the section called “Session program”).

The default is “${x_bindir}/xterm”.

The PATH environment variable for non-root Sessions.

The default depends on the system kdm was built on.

The PATH environment variable for all programs but non-root Sessions. Note that it is good practice not to include . (the current directory) into this entry.

The default depends on the system kdm was built on.

The SHELL environment variable for all programs but the Session.

The default is “/bin/sh”.

When kdm is unable to write to the usual user authorization file ($HOME/.Xauthority), it creates a unique file name in this directory and points the environment variable XAUTHORITY at the created file.

The default is “/tmp”.

If true, UserAuthDir will be used unconditionally.

The default is “false”.

If enabled, kdm will automatically restart a session after an X-Server crash (or if it is killed by Alt-Ctrl-BackSpace). Note that enabling this feature opens a security hole: a secured display lock can be circumvented (unless KDE's built-in screen locker is used).

The default is “false”.

If disabled, do not allow root (and any other user with UID = 0) to log in directly.

The default is “true”.

If disabled, only users that have passwords assigned can log in.

The default is “true”.

Who is allowed to shut down the system. This applies both to the greeter and to the command sockets.

The default is “All”.

Who is allowed to abort active sessions when shutting down.

The default is “All”.

The default choice for the shutdown condition/timing.

The default is “Schedule”.

How to offer shutdown scheduling options:

The default is “Never”.

Enable password-less logins on this display. Use with extreme care!

The default is “false”.

The users that do not need to provide a password to log in. Items which are prefixed with @ represent all users in the user group named by that item. * means all users but root (and any other user with UID = 0). Never list root.

Empty by default.

Enable automatic login. Use with extreme care!

The default is “false”.

If true, auto-login after logout. If false, auto-login is performed only when a display session starts up.

The default is “false”.

The delay in seconds before automatic login kicks in. This is also known as “Timed Login”.

The user to log in automatically. Never specify root!

Empty by default.

The password for the user to log in automatically. This is not required unless the user is logged into a NIS or Kerberos domain. If you use this option, you should chmod 600 kdmrc for obvious reasons.

Empty by default.

Immediately lock the automatically started session. This works only with KDE sessions.

The default is “false”.

A list of directories containing session type definitions. Ordered by falling priority.

The default is “${kde_datadir}/kdm/sessions”.

The file (relative to the user's home directory) to redirect the session output to.

The following character pairs are replaced by their value:

When the constructed filename cannot be used safely and the specification contains %stuffr, other names will be tried - this time expanding %stuffr to stuff followed by a random number.

The default is “.xsession-errors”.

Fallback when ClientLogFile cannot be used. The same expansions are supported. Do not use relative paths here.

The default is “/tmp/xerr-%u-%d%-r”.

Specify whether kdm's built-in utmp/wtmp/lastlog registration should be used. If it is not, the tool sessreg should be used in the Startup and Reset scripts, or, alternatively, the pam_lastlog module should be used on PAM-enabled systems.

The default is “true”.

Specify the widget style for the greeter. Empty means to use the built-in default which currently is Oxygen-air.

Empty by default.

Specify the widget color scheme for the greeter. Empty means to use the built-in default which currently is Oxygen-air.

Empty by default.

What should be shown in the greeter righthand of the input lines (if UserList is disabled) or above them (if UserList is enabled):

The default is “Clock”.

The image to show in the greeter if LogoArea is Logo.

Empty by default.

The relative coordinates (percentages of the screen size; X,Y) at which the center of the greeter is put. kdm aligns the greeter to the edges of the screen it would cross otherwise.

The default is “50,50”.

The screen the greeter should be displayed on in multi-headed and Xinerama setups. The numbering starts with 0. For Xinerama, it corresponds to the listing order in the active ServerLayout section of XF86Config; -1 means to use the upper-left screen, -2 means to use the upper-right screen.

The headline in the greeter. An empty greeting means none at all.

The following character pairs are replaced by their value:

The default is “Welcome to %s at %n”.

Whether the fonts used in the greeter should be antialiased.

The default is “false”.

The font for the greeter headline. The value is encoded.

The default is “Serif 20pt bold”.

The normal font used in the greeter. The value is encoded.

The default is “Sans Serif 10pt”.

The font used for the “Login Failed” message. The value is encoded.

The default is “Sans Serif 10pt bold”.

What to do with the Num Lock modifier for the time the greeter is running:

The default is “Keep”.

Language and locale to use in the greeter, encoded like $LANGUAGE. If empty, the settings from the environment are used.

Empty by default.

Enable autocompletion in the username line edit.

The default is “false”.

Show a user list with unix login names, real names, and images in the greeter.

The default is “true”.

This option controls which users will be shown in the user view (UserList) and/or offered for autocompletion (UserCompletion). If it is Selected, SelectedUsers contains the final list of users. If it is NotHidden, the initial user list contains all users found on the system. Users contained in HiddenUsers are removed from the list, just like all users with a UID greater than specified in MaxShowUID and users with a non-zero UID less than specified in MinShowUID. Items in SelectedUsers and HiddenUsers which are prefixed with @ represent all users in the user group named by that item. Finally, the user list will be sorted alphabetically, if SortUsers is enabled.

The default is “NotHidden”.

See ShowUsers.

Empty by default.

See ShowUsers.

Empty by default.

See ShowUsers.

See ShowUsers.

The default is “65535”.

See ShowUsers.

The default is “true”.

If UserList is enabled, this specifies where kdm gets the images from:

The images can be in any format Qt recognizes, but the filename must match kdm's expectations: .face.icon should be a 48x48 icon, while .face should be a 300x300 image. Currently the big image is used only as a fallback and is scaled down, but in the future it might be displayed full-size in the logo area or a tooltip. To be accessible to kdm, the images must be world readable and their parent directories must be world executable.

The default is “AdminOnly”.

See FaceSource.

The default is “${kde_datadir}/kdm/faces”.

Specify, if/which user should be preselected for log in:

If FocusPasswd is enabled and a user was preselected, the cursor is placed in the password input field automatically.

The default is “None”.

See PreselectUser.

Empty by default.

See PreselectUser.

The default is “false”.

If this is true, the entered password is echoed as bullets. Otherwise, no feedback is given at all.

The default is “true”.

If enabled, kdm will automatically start the krootimage program to set up the background; otherwise, the Setup program is responsible for the background.

The default is “true”.

The configuration file to be used by krootimage. It contains a section named [Desktop0] like kdesktoprc does. Its options are not described herein; guess their meanings or use the control center.

The default is “${kde_confdir}/kdm/backgroundrc”.

To improve security, the greeter may grab mouse and keyboard input so no other X clients can eavesdrop it. However, the X authorization mechanism will usually prevent malicious X clients from connecting in the first place. Consequently, enabling grabs for local displays is pointless and only marginally improves security for remote displays.

The default is “IfNoAuth”.

To improve security, the greeter grabs the X-Server and then the input when it starts up. This option specifies if the X-Server grab should be held for the duration of the name/password reading. When disabled, the X-Server is ungrabbed after the input grabs succeed; otherwise, the X-Server is grabbed until just before the session begins.

The default is “false”.

This option specifies the maximum time kdm will wait for the grabs to succeed. A grab may fail if some other X-client has the X-Server or the keyboard grabbed, or possibly if the network latencies are very high. You should be cautious when raising the timeout, as a user can be spoofed by a look-alike window on the display. If a grab fails, kdm kills and restarts the X-Server (if possible) and the session.

The default is “3”.

Warn, if a display has no X-authorization. This will be the case if

The default is “true”.

Specify whether the greeter of local displays should start up in host chooser (remote) or login (local) mode and whether it is allowed to switch to the other mode.

The default is “LocalOnly”.

A list of hosts to be automatically added to the remote login menu. The special name * means broadcast. Has no effect if LoginMode is LocalOnly.

The default is “*”.

Use this number as a random seed when forging saved session types, etc. of unknown users. This is used to avoid telling an attacker about existing users by reverse conclusion. This value should be random but constant across the login domain.

Enable kdm's built-in xconsole. Note that this can be enabled for only one display at a time. This option is available only if kdm was configured with --enable-kdm-xconsole.

The default is “false”.

The data source for kdm's built-in xconsole. If empty, a console log redirection is requested from /dev/console. Has no effect if ShowLog is disabled.

Empty by default.

Specify conversation plugins for the login dialog; the first in the list is selected initially. Each plugin can be specified as a base name (which expands to $kde_modulesdir/kgreet_base) or as a full pathname.

Conversation plugins are modules for the greeter which obtain authentication data from the user. Currently only the classic plugin is shipped with KDE; it presents the well-known username and password form.

The default is “classic”.

Same as PluginsLogin, but for the shutdown dialog.

The default is “classic”.

A list of options of the form Key=Value. The conversation plugins can query these settings; it is up to them what possible keys are.

Empty by default.

Show the Console Login action in the greeter (if ServerTTY/ConsoleTTYs is configured).

The default is “true”.

Show the Restart X Server/Close Connection action in the greeter.

The default is “true”.

A program to run while the greeter is visible. It is supposed to preload as much as possible of the session that is going to be started (most probably).

Empty by default.

Whether the greeter should be themed. Note that the themed greeter is challenged accessibility-wise, and themes may lack support for features like a user list or alternative authentication methods.

The default is “false”.

The theme to use for the greeter. Can point to either a directory or an XML file.

Empty by default.

Enable the Alt-Ctrl-D shortcut to toggle greeter theme debugging.

The default is “false”.