Where communities thrive


  • Join over 1.5M+ people
  • Join over 100K+ communities
  • Free without limits
  • Create your own community
People
Activity
  • Jan 15 10:06
    Firstyear reopened #91
  • Jan 15 10:06
    Firstyear commented #91
  • Jan 15 02:30

    Firstyear on 20220109-device-credential-design

    (compare)

  • Jan 15 02:30

    Firstyear on master

    Add initial design of device au… (compare)

  • Jan 15 02:30
    Firstyear closed #633
  • Jan 14 04:44
    Firstyear closed #91
  • Jan 14 04:44
    Firstyear commented #91
  • Jan 13 20:56
  • Jan 13 00:31

    Firstyear on main

    Add meme (compare)

  • Jan 13 00:30

    Firstyear on main

    Add meme (compare)

  • Jan 12 04:02

    Firstyear on v0.1.0

    (compare)

  • Jan 12 03:42

    Firstyear on main

    Add to readme (compare)

  • Jan 12 03:31

    Firstyear on main

    Initial 0.1.0 (compare)

  • Jan 12 02:26
    Firstyear commented #91
  • Jan 12 02:21
    dangfan commented #91
  • Jan 12 01:58
    Firstyear commented #91
  • Jan 11 09:12
    sorz opened #91
  • Jan 09 06:53
    Firstyear synchronize #633
  • Jan 09 06:53

    Firstyear on 20220109-device-credential-design

    Add extra thoughts (compare)

  • Jan 09 02:38
    yaleman opened #634
Triss Healy
@trissylegs
% cat sudo       
#%PAM-1.0
auth        include        system-auth
account        include        system-auth
session        include        system-auth
Firstyear
@Firstyear
Yeah, exactly.
It's includidng system auth
Triss Healy
@trissylegs
I'll get systemauth in a gist it's longer
Firstyear
@Firstyear
I think for su and su-l though here, you'll have to be careful because I think that anyone who matches those assertions can SU.
Honestly, I don't use su much, I use sudo,
But I'd say that would be your issue
Triss Healy
@trissylegs
I think sudo has the same error. (But actually prints pam messages)
Firstyear
@Firstyear
Right, so then we'll need to see system-auth
But getting closer :)
Triss Healy
@trissylegs
So uhhh
Firstyear
@Firstyear
Uh oh.
Triss Healy
@trissylegs
I just run sudo --login and it worked
Firstyear
@Firstyear
Yeah.
But .....
Triss Healy
@trissylegs
$ sudo --user=nirya --login

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:

    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

[sudo] password for safety: 
acct_mgmt
args -> ["debug", "ignore_unknown_user"]
opts -> Options { debug: true, use_first_pass: false, ignore_unknown_user: true }
Firstyear
@Firstyear
sudo -s or sudo -i work?
Yeah,
Like I said, that su file, only allows pam_unix
Triss Healy
@trissylegs
Hmmm. Can't login to a tty though?
Firstyear
@Firstyear
Any debug messages there from the tty? IIRC tty's go through a different pam module nd again, may have their own requirements.
I think tty goes though /etc/pam.d/login
Triss Healy
@trissylegs
Ahh sudo might be doing this via pam_rootok.so.
Firstyear
@Firstyear
Possible.
I'm gonna have to run off shortly though, friends coming for dinner.
But I think you're on the right track now?
If not, I'll look in a few hours :)
Triss Healy
@trissylegs
Ok I'm going fiddle with PAM settings until this works
nirya@Asuka ~ % sudo 'echo test'
[sudo] password for nirya: 
sm_authenticate
args -> ["debug", "ignore_unknown_user"]
opts -> Options { debug: true, use_first_pass: false, ignore_unknown_user: true }
acct_mgmt
args -> ["debug", "ignore_unknown_user"]
opts -> Options { debug: true, use_first_pass: false, ignore_unknown_user: true }
sudo: PAM account management error: Authentication service cannot retrieve authentication info
sudo: a password is required
Firstyear
@Firstyear
Have yo uset a posix pw on the account?
Triss Healy
@trissylegs
Pretty sure
I'll do it again
It did not fix it
Triss Healy
@trissylegs
# pamtester sudo nirya authenticate
sm_authenticate
args -> ["debug", "ignore_unknown_user"]
opts -> Options { debug: true, use_first_pass: false, ignore_unknown_user: true }
Password: 

pamtester: successfully authenticated
So It's failing after authenticate
Triss Healy
@trissylegs
Ok I can log-in now:
This appeared to be the culprit:
account    required                    pam_unix.so
Logged via GDM works too
Triss Healy
@trissylegs
pffftt. pkexec fails if debug is enabled because the debug messages break its auth helper
Firstyear
@Firstyear
Yeah, look at the suse pam configs @trissylegs
# /etc/pam.d/common-auth-pc
auth        required      pam_env.so
auth        [default=1 ignore=ignore success=ok] pam_localuser.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 1000 quiet_success
auth        sufficient    pam_kanidm.so ignore_unknown_user
auth        required      pam_deny.so
Note the "pam_localuser.so"? With default=1? That means "if the account is NOT local, jump one module."
So that way it'll check your account, say "it's not local", then it will jump over pam_unix to pam_succedd_if and check your uid>=1000, then only if that passes, does it go to pam_kani
And the pam_deny is a "catch all" safety net.
Firstyear
@Firstyear
@/all Hi everyone, we are doing a survey on rust usage, would appreciate your responses https://survey.opensuse.org/index.php/417611?lang=en
James Hodgkinson
@yaleman
clearly I need to hang out here more often, @trissylegs I ran into similar derpy problems with PAM the other day :S
Firstyear
@Firstyear
Pam is a special hell.
James Hodgkinson
@yaleman
:100:
so, speaking of cursed things, I was thinking it'd be possible to add TOTP support as a minimum to login for kanidm ^_^
(ssh/console login that is)
and... I have other cursed ideas for ... other things, but that's later
Firstyear
@Firstyear
It's not
Because of offline pw caching.