Lock the screen

Leaving the computer logged in with programs running is quite routine for me. Uptimes of several weeks are not unusual.

However, leaving X or a terminal open while you are away can be a security and privacy risk – with physical access to the computer, someone with bad intentions can do a lot of damage if they find it logged into your account (or worse, into root!): looking at the passwords saved in your browser (never save passwords in the browser!), reaching confidential files, or just trolling your Facebook.

Luckily there are a few programs made exactly for this. In this post I will comment a little on those programs and on some screen locking techniques.

tl;dr: vlock -as is the safest way to lock the computer.

Naive methods

Unconventional window managers

It is quite interesting how, out of unfamiliarity with Unix-like systems, most people cannot use my computer even when it is not locked =].

At home I can leave my computer running Awesome, PekWM, Xmonad, DWM or another window manager that is nothing like Windows, and that alone is enough to keep them puzzling over what is going on for a good while. It is a bit like opening Vi and asking a first-year student to use it.

Switching tty

People may take a while to work out a DWM, but with enough determination they will eventually manage it. But if I switch between terminals (Ctrl+Alt+F2), a rather intimidating black screen appears.

These naive methods may work at your parents’ house, but be aware that trying them in an environment full of computer-savvy colleagues and technology enthusiasts is a guaranteed surprise.

Try leaving your computer logged in at a university lab, a student house, or technology events like FISL and Campus Party (at CP you will still be safe in the gamer and social media area…). One moment you are asking someone to keep an eye on your laptop while you go to the toilet, and the next you find out you have become a Justin Bieber fan.

The best solution is to always carry your laptop with you. For situations where that is not possible, the programs I will mention may be the answer.

Programs

Screen

Screen is the best known terminal multiplexer.

To install Screen on Arch Linux, run the command below:

julio@julio-acer ~> sudo pacman -S screen

One of screen’s many features is precisely the ability to lock the terminal, with one of the following shortcuts: C-a x and C-a C-x

But this method also has some problems: it only locks what is running inside screen. If you started X, even from inside screen, it will still be reachable.

Xtrlock

If you are using X and only need to lock the keyboard and mouse clicks while keeping the image on the screen, Xtrlock (available on the AUR) is a reasonable, lightweight option. Just run Xtrlock and the cursor turns into a padlock, only going back to normal after you type the user’s password.

As the name suggests, this program locks X only. If you or root are logged into a terminal, the process can be killed with a killall xtrlock.

It is also important to avoid staying logged into the terminal that was used to start X. If, after logging into tty1, you just type startx, someone with bad intentions could simply kill the process with CTRL+c. I found a few ways to avoid that:

1. Start X with nohup startx &; disown; sleep 5; exit.

2. Start X with an exec startx.

3. Start X with startx && vlock -a || vlock -a (I will talk about vlock later).

4. Edit xorg.conf to disable Ctrl+Alt+Fn and Ctrl+Alt+Backspace:

   Option "DontVTSwitch" "True" and Option "DontZap" "True".

5. Start X inside screen and log out of tty1.

6. Use a graphical login.

It has other shortcomings too, such as not locking input devices other than the mouse and keyboard.

Slock

Like every program from <suckless.org>, Slock is very minimal. It is even simpler than xtrlock.

Run the following command to install it on Arch Linux:

julio@acer ~> sudo pacman -S slock

slock simply blanks the screen until the password of the user who started it is typed.

Xscreensaver

I have never used Xscreensaver, because it looks bloated. But I see that many people like it and recommend it.

Xautolock

slock and xtrlock follow the Unix philosophy well: a program should do one thing and do it well. They simply lock the screen and do nothing else.

A very useful feature I have seen in other screen lockers, such as Ubuntu’s, is auto locking. That feature can be had with xautolock.

xautolock lets you run a program after a given period of inactivity.

For example, to run slock after 10 minutes of inactivity, add the following line to ~/.xinitrc:

xautolock -time 10 -locker slock -nowlocker slock -detectsleep -corners 0+00 -cornerdelay 5 &

Read more about the options you can pass to xautolock in the manual (man xautolock).

Xautolock and Mplayer

An annoying consequence of having xautolock set to lock the screen automatically is that we are not always really inactive when we go a long time without sending a command to X (typing or moving the cursor). Watching films is one of those situations.

Luckily Mplayer’s developers saw this coming and added the -stop-xscreensaver argument:

julio@acer ~> mplayer -stop-xscreensaver video.mkv

man mplayer itself recommends -stop-xscreensaver, but if it fails (it worked very well here!), you can pass a command for mplayer to call every 30 seconds using the -heartbeat-cmd option:

julio@acer ~> mplayer -heartbeat-cmd="xscreensaver-command -deactivate" video.mkv

The same problem happens with other players and with flash and YouTube videos, but unfortunately the solutions I found for those cases are not good at all:

1. xautolock -exit -> watch the video -> restart xautolock

2. Keep moving the cursor from time to time.

Vlock

Finally there is Vlock, which I consider the best option for locking terminals; it can also be used together with the other options for extra protection.

1. Install Vlock:

   julio@julio-acer ~> sudo pacman -S vlock
   

Update of 16/01/2013: kbd already ships vlock. If you already have kbd, trying to install vlock will cause a conflict.

2. Lock only the current terminal with -c

   julio@julio-acer ~> vlock -c
   This TTY is now locked.
   
   Please press [ENTER] to unlock.
   julio's Password:
   

3. Lock every terminal with -a

   julio@julio-acer ~> vlock -a
   vlock: this terminal is not a virtual console
   

   Oops! This error will come up if you try to run vlock -a in urxvt, xterm, and so on. Press Ctrl+Alt+F1 to go to TTY1 and repeat the command:

   julio@julio-acer ~> vlock -a
   The entire console display is now completely locked.
   You will not be able to switch to another virtual console.
   
   Please press [ENTER] to unlock.
   julio's Password:
   

There we go: the system is completely locked and will only unlock with your password or root’s. Or almost — looking at the manual, I saw that vlock has an option (-s) to keep the SysRq key from killing the program. I did not test it, since my keyboard does not even have that key, but that information mattered, because I ran a few tests and found that you really can unlock the computer remotely:

1. Logged in as the user ’teste’, I locked every terminal:

   teste@julio-acer ~> vlock -a
   

2. I connected to the computer over SSH and killed the process without trouble:

   julio@julio-acer ~> killall vlock-main
   

3. I also tested with the ‘-s’ option, which needs superuser permission:

   [root@julio-acer ~]# vlock -as
   

4. And I could only kill the process using sudo. Which was to be expected.

   julio@julio-acer ~> killall vlock-main
   vlock-main(26420): Operation not permitted
   vlock-main: no process found
   

   julio@julio-acer ~> sudo killall vlock-main
   

The only problem with this is that when that user manages to unlock the computer, they will have access to the account of whoever locked it. That does not worry me, since I am the computer’s only user. But if I ever add more users (none with sudo rights), I will keep in mind that it is better to lock the computer as root.

Links

• http://www.gentoo-wiki.info/TIP_Fix_The_Login_Security_Hole
• http://manpages.ubuntu.com/manpages/precise/en/man5/xorg.conf.5.html