Where communities thrive


  • Join over 1.5M+ people
  • Join over 100K+ communities
  • Free without limits
  • Create your own community
People
Activity
  • 14:03

    yaleman on ui_things

    account person extend was showi… first run on a user profile pag… (compare)

  • 09:38
    yaleman commented #872
  • 09:34
    yaleman edited #872
  • 09:25
    yaleman synchronize #872
  • 09:25

    yaleman on issue860

    docs tweaks (compare)

  • 08:11
    yaleman ready_for_review #872
  • 08:11
    yaleman synchronize #872
  • 08:11

    yaleman on issue860

    quick run on settings I kissed the QS and I liked it before rebase and 28 more (compare)

  • 07:33
    Firstyear synchronize #872
  • 07:33

    Firstyear on issue860

    Fixes (compare)

  • 05:52
    Firstyear synchronize #908
  • 05:52

    Firstyear on 68-replication-changelog-basics

    Fix up logging (compare)

  • 05:38
    Firstyear opened #908
  • 05:37

    Firstyear on 68-replication-changelog-basics

    Foundations Tests pass and we have base ver… More progress and 4 more (compare)

  • 05:01

    Firstyear on v0.2.4

    (compare)

  • 05:01

    Firstyear on master

    (cargo-release) version 0.2.4 (compare)

  • 05:00

    Firstyear on master

    Improve eq (compare)

  • 03:18

    github-actions[bot] on gh-pages

    deploy: 9cf4e180dc58ab81cd9a9c2… (compare)

  • 03:15

    yaleman on kanidm_cli_docker

    (compare)

  • 03:04

    Firstyear on master

    one day james, one day. (#907) (compare)

Triss Healy
@trissylegs
Oh this is the message I get:
$ su -l nirya
Password: 
su: Authentication service cannot retrieve authentication info
Firstyear
@Firstyear
can you show me getent group humans?
Triss Healy
@trissylegs
$ getent group humans
humans:x:2001:test_user,nirya
Firstyear
@Firstyear
Which distro?
Triss Healy
@trissylegs
Arch linux. Editing PAM is mostly been guessing because its different to both SUSE and Redhat
Firstyear
@Firstyear
Right
Okay, so the next steps would be

systemctl edit kanidm-unix.service

[Service]
Environment="RUST_LOG=kanidm=debug"

in pam, on lines with pam_kanidm.so, add the option debug

Then restart kanidm-unixd, and try su again.
Youll have more info in journalctl, and it prints more to the TTY from the pam module.
But after that I'll need to see your /etc/pam.d/su and probably other fules.
files*
There is a troubleshooting section here which is honestly what I'm reading XD
Triss Healy
@trissylegs
Yea. I've been through most of that
I think it'll be something in /etc/pam.d
Firstyear
@Firstyear
Yeah, most likely
Pam is really tricky and delicate at the best of times :(
Triss Healy
@trissylegs
Firstyear
@Firstyear
That all looks happy
content of /etc/pam.d/su ?
It may have include statements, so if those are present, can you provide those files too?
Triss Healy
@trissylegs
From what I gathered. Arch linux pam nearly all includes system-login
Firstyear
@Firstyear
Yeah, but better to check what /etc/pam.d/su actually says :P
Triss Healy
@trissylegs
% cat su
#%PAM-1.0
auth            sufficient      pam_rootok.so
# Uncomment the following line to implicitly trust users in the "wheel" group.
#auth           sufficient      pam_wheel.so trust use_uid
# Uncomment the following line to require a user to be in the "wheel" group.
#auth           required        pam_wheel.so use_uid
auth            required        pam_unix.so
account         required        pam_unix.so
session            required        pam_unix.so
password        include         system-auth
pam.d/su-l is identical
Firstyear
@Firstyear
Yeah, that would be the isses, it's not including system-auth for auth/account/session, it's only using pam_unix
So it only allows local accounts.
Triss Healy
@trissylegs
Ahh
Firstyear
@Firstyear
Have a look at /etc/pam.d/sudo
It's content would likely be more alligned to what you want here.
Triss Healy
@trissylegs
% cat sudo       
#%PAM-1.0
auth        include        system-auth
account        include        system-auth
session        include        system-auth
Firstyear
@Firstyear
Yeah, exactly.
It's includidng system auth
Triss Healy
@trissylegs
I'll get systemauth in a gist it's longer
Firstyear
@Firstyear
I think for su and su-l though here, you'll have to be careful because I think that anyone who matches those assertions can SU.
Honestly, I don't use su much, I use sudo,
But I'd say that would be your issue
Triss Healy
@trissylegs
I think sudo has the same error. (But actually prints pam messages)
Firstyear
@Firstyear
Right, so then we'll need to see system-auth
But getting closer :)
Triss Healy
@trissylegs
So uhhh
Firstyear
@Firstyear
Uh oh.
Triss Healy
@trissylegs
I just run sudo --login and it worked
Firstyear
@Firstyear
Yeah.
But .....
Triss Healy
@trissylegs
$ sudo --user=nirya --login

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

[sudo] password for safety: 
acct_mgmt
args -> ["debug", "ignore_unknown_user"]
opts -> Options { debug: true, use_first_pass: false, ignore_unknown_user: true }
Firstyear
@Firstyear
sudo -s or sudo -i work?
Yeah,
Like I said, that su file, only allows pam_unix