To display the root user on the CentOS 8 graphical login screen, you must modify the GDM3 configuration file located at
/etc/gdm/custom.conf. By adding the line
AllowRoot=true under the
[daemon] section and restarting the GDM service, the system will permit direct root authentication. This approach overrides the default security policy that hides privileged accounts from the login interface.
Understanding GDM3 Security Defaults
CentOS 8 utilizes GNOME Display Manager (GDM3) as its primary graphical login handler. By design, modern Linux distributions disable direct root logins via the GUI to prevent accidental system damage and reduce the attack surface for brute-force attempts. When you boot into the graphical environment, the login prompt typically lists standard users but omits the root account entirely. This is a deliberate security feature known as "root hiding." While this enhances security, some administrators or developers working in isolated environments may require direct root access for troubleshooting or specific application testing. Modifying the configuration allows you to bypass this restriction without altering the underlying kernel security modules.
Modifying the Custom Configuration File
The core of this solution lies in editing the local GDM3 configuration file. You should never edit the default
defaults.conf directly, as updates may overwrite your changes. Instead, always use
/etc/gdm/custom.conf, which is designed for administrator overrides. Open a terminal and gain root privileges using
sudo to launch your preferred text editor. For example, you can run
sudo nano /etc/gdm/custom.conf. Once the file is open, locate the
[daemon] section. If it does not exist, create it at the top of the file. Under this section, add the following line:
[daemon]
AllowRoot=true
This directive explicitly tells GDM3 to include the root account in the list of available users on the greeter screen. Ensure there are no leading spaces before the key-value pair, as strict parsing rules apply to INI-style configuration files. After making this change, save the file and exit the editor. It is crucial to verify that the syntax is correct; any typos in the section headers or keys can cause GDM3 to fail to load, potentially leaving you with a black screen.
Restarting the Display Manager
Changes to the GDM configuration do not take effect immediately while the session is active. You must restart the display manager service to apply the new settings. The most reliable method is to switch to a virtual console by pressing
Ctrl+Alt+F3, logging in with your regular sudo-enabled account, and executing the command
sudo systemctl restart gdm. Alternatively, if you are already in a TTY environment, you can reboot the system entirely. Rebooting is often safer if you are unsure about the stability of the service restart, as it ensures all display-related processes initialize cleanly. If you choose to restart the service, be aware that your current graphical session will terminate, and you will be returned to the login screen.
Verifying and Securing Access
Once the system returns to the graphical login screen, you should see the root user listed among the available options. Click on the root entry and enter the root password to authenticate. If the login fails, check the system logs using
journalctl -xe to identify any permission errors or configuration syntax issues. It is important to note that enabling root GUI access does not change the root password requirements. You must have a strong, complex password set for the root account to maintain security. Additionally, consider reviewing your SSH configurations if remote root login is involved, as similar restrictions often apply there. For more information on managing sudo privileges securely, refer to our guide on
Sudo Ask Root Password: A Guide for Linux Users.
Common Troubleshooting Steps
If the root user still does not appear after modifying the configuration, several factors might be interfering. First, ensure that the
custom.conf file has the correct permissions. It should be owned by root and readable only by root and the group, typically with permissions set to
600 or
644. Incorrect permissions can prevent GDM3 from reading the file. Second, verify that you are editing the correct file. Some custom installations might use different paths, though
/etc/gdm/custom.conf is standard for CentOS 8. Third, check for conflicting policies. If you have SELinux enabled, although rare for this specific setting, ensure that the context of the configuration file has not been altered in a way that blocks read access. If you encounter issues with user directories after creating new accounts, consult our article on
Fixing User Directory Issues with 'sudo useradd -s /usr/bin/bash -m jason' to ensure your environment is properly configured.
Frequently Asked Questions
Is it safe to allow root login on the GUI?
It is generally not recommended for production servers due to security risks, but it is acceptable for isolated development machines. Direct root access bypasses many safety checks that
sudo provides, increasing the chance of accidental system modification. Always ensure your root password is strong and your network is secured if you enable this feature.
Why did my GDM stop starting after I edited custom.conf?
This usually happens due to a syntax error in the configuration file, such as a missing bracket or an invalid key name. GDM3 is strict about INI file formats and will refuse to start if it cannot parse the configuration correctly. Check the journal logs for specific error messages indicating which line caused the failure.
Can I use this method on CentOS Stream 9?
Yes, the process remains largely the same for CentOS Stream 9 as it continues to use GDM3. However, newer versions may introduce additional security layers like Wayland defaults or stricter SELinux policies. Always test the configuration in a non-production environment first to ensure compatibility with your specific version.
How do I revert this change if I want to hide root again?
Simply open
/etc/gdm/custom.conf again and either delete the
AllowRoot=true line or comment it out by adding a semicolon (
;AllowRoot=true) at the beginning. Save the file and restart the GDM service or reboot the system to restore the default secure behavior.