Guest users can resturn to admin with no password prompt

[AJenbo]

Senario:

Admin clicks his Me-menu and selects the guest session to allow a untrusted person to use the computer. Simply pressing ctrl+alt+f7 returns back to the admins screen with out a password prompt and might even preforme administrative tasks if sudo is still elivated.

Note the guest session would here be found under ctrl+alt+f8

[Marc Deslauriers (mdeslaur)]

What release of Ubuntu are you using, and could you please give the exact steps necessary to reproduce this?

Thanks.

[AJenbo (ajenbo)]

Ubuntu 11.10

Log in to the desktop of your admin.
Press the name in the upper right and pick Guest Session.
Press ctrl+alt+f7

The guest user is not back on the admins desktop with out being prompted for a password.

[Sebastien Bacher (seb128)]

the indicator should be locking the session, I can't confirm the issue there

what screensaver do you use?

[AJenbo (ajenbo)]

I haven't set a screensaver but upgradet from 11.04

[AJenbo (ajenbo)]

I just tested on a clean install of 11.10 and here the issue does not appear. I'll retest on my laptop when i get home later today.

[AJenbo (ajenbo)]

Ok seams it is different then i remembered it, what you have to do is the following:

Log in to your account.
Press ctrl+alt+f8 (this will work weather you have already started a guest session or not)
Pressing ctrl+alt+f7 will bring you back to your personal session with out a password prompt.

So the issue is still there but luckily slightly less likely to be exposed.

[Marc Deslauriers (mdeslaur)]

This is expected behaviour. If you are manually changing virtual terminals, nothing is locking your screen. If you want your screen locked, you need to lock it manually before changing virtual terminals.