You are not logged in.
Hey,
I've been running the same .pam_environment for all my users for quite some time, including my root user. Since some time, I think after the update of pam and pambase, the root user no longer loads the variables listed in .pam_environment.
My .pam_environment: https://github.com/sQVe/dotfiles/blob/m … nvironment
Further settings that might be useful:
% cat system-auth /etc/pam.d
#%PAM-1.0
auth required pam_faillock.so preauth
# Optionally use requisite above if you do not want to prompt for the password
# on locked accounts.
auth [success=2 default=ignore] pam_unix.so try_first_pass nullok
-auth [success=1 default=ignore] pam_systemd_home.so
auth [default=die] pam_faillock.so authfail
auth optional pam_permit.so
auth required pam_env.so
auth required pam_faillock.so authsucc
# If you drop the above call to pam_faillock.so the lock will be done also
# on non-consecutive authentication failures.
-account [success=1 default=ignore] pam_systemd_home.so
account required pam_unix.so
account optional pam_permit.so
account required pam_time.so
-password [success=1 default=ignore] pam_systemd_home.so
password required pam_unix.so try_first_pass nullok shadow
password optional pam_permit.so
session required pam_limits.so
session required pam_unix.so
session optional pam_permit.so% cat system-login /etc/pam.d
#%PAM-1.0
auth required pam_shells.so
auth requisite pam_nologin.so
auth include system-auth
account required pam_access.so
account required pam_nologin.so
account include system-auth
password include system-auth
session optional pam_loginuid.so
session optional pam_keyinit.so force revoke
session include system-auth
session optional pam_motd.so motd=/etc/motd
session optional pam_mail.so dir=/var/spool/mail standard quiet
-session optional pam_systemd.so
session required pam_env.so user_readenv=1I've tried adding a new line to the end of the file and other tips and tricks listed in other relevant issues due to the pam update.
I'd appreciate any help I can get!
Last edited by sQVe (2020-09-23 18:52:18)
Offline
Have you tested downgrading both pambase and pam to see if the update was the cause?
Offline
Have you tested downgrading both pambase and pam to see if the update was the cause?
No. I tried downgrading pam but that made me unable to log in. Is it safe if I downgrade both?
Last edited by sQVe (2020-09-21 14:20:10)
Offline
Yes you need to downgrade to pambase 20190105.1-2 and pam 1.3.1-2 or you would have to adjust system-auth and system-login.
Possibly related https://bugs.archlinux.org/task/67636
Offline
Yes you need to downgrade to pambase 20190105.1-2 and pam 1.3.1-2 or you would have to adjust system-auth and system-login.
Possibly related https://bugs.archlinux.org/task/67636
Yes, as expected downgrading fixes the issues. My root user now properly loads all variables.
I'm really unsure on how to fix this with the newer versions. I tried a very simple .pam_environment like:
FOO="bar"but that made no difference.
Offline
If you rebuild the pam package with the following applied to the PKGBUILD
diff --git a/trunk/PKGBUILD b/trunk/PKGBUILD
index d88c2bf..52d20d0 100644
--- a/trunk/PKGBUILD
+++ b/trunk/PKGBUILD
@@ -16,6 +16,7 @@ source=(https://github.com/linux-pam/linux-pam/releases/download/v$pkgver/Linux-
395915dae1571e10e2766c999974de864655ea3a.patch
af0faf666c5008e54dfe43684f210e3581ff1bca.patch
0e9b286afe1224b91ff00936058b084ad4b776e4.patch
+ https://github.com/linux-pam/linux-pam/commit/563d21d6dbb6d64613919ccb1cc939bae546baab.patch
$pkgname.tmpfiles)
validpgpkeys=(
'8C6BFD92EE0F42EDF91A6A736D1A7F052E5924BB' # Thorsten Kukuk
@@ -27,6 +28,7 @@ sha256sums=('cd6d928c51e64139be3bdb38692c68183a509b83d4f2c221024ccd4bcddfd034'
'cd2440d7bec55fa91e499060c0bf248f4fd20e7a0ef613eb7a06ee083f7ce21b'
'ac3e1d307756f5975587a7846500414c02d2b60acb271017b9c7aa6f47c89875'
'68f81b67dde5ee6003524b6b14e2d6f27edcfc0a2bde4c55a1cacbc6e299c207'
+ '9d55399b607fb1df70285a1be9fd7552195944afc80a482af427d3bfa0cf293c'
'5631f224e90c4f0459361c2a5b250112e3a91ba849754bb6f67d69d683a2e5ac')
options=('!emptydirs')
@@ -36,6 +38,7 @@ prepare() {
patch -p1 -i ../395915dae1571e10e2766c999974de864655ea3a.patch
patch -p1 -i ../af0faf666c5008e54dfe43684f210e3581ff1bca.patch
patch -p1 -i ../0e9b286afe1224b91ff00936058b084ad4b776e4.patch
+ patch -p1 -R -i ../563d21d6dbb6d64613919ccb1cc939bae546baab.patch
}
build() {Is the issue still present?
Offline
Is the issue still present?
Yes. I just tried it and it made no difference.
Offline
How do you log into the system terminal login, display manager, SSH?
Offline
How do you log into the system terminal login, display manager, SSH?
I simply log in via the terminal.
Offline
See if the issue is connected to the change to user_readenv:
diff --git a/trunk/PKGBUILD b/trunk/PKGBUILD
index d88c2bf..8b681c2 100644
--- a/trunk/PKGBUILD
+++ b/trunk/PKGBUILD
@@ -16,6 +16,7 @@ source=(https://github.com/linux-pam/linux-pam/releases/download/v$pkgver/Linux-
395915dae1571e10e2766c999974de864655ea3a.patch
af0faf666c5008e54dfe43684f210e3581ff1bca.patch
0e9b286afe1224b91ff00936058b084ad4b776e4.patch
+ https://github.com/linux-pam/linux-pam/commit/f83fb5f25263356391d71da595def409e8dd90f7.patch
$pkgname.tmpfiles)
validpgpkeys=(
'8C6BFD92EE0F42EDF91A6A736D1A7F052E5924BB' # Thorsten Kukuk
@@ -27,6 +28,7 @@ sha256sums=('cd6d928c51e64139be3bdb38692c68183a509b83d4f2c221024ccd4bcddfd034'
'cd2440d7bec55fa91e499060c0bf248f4fd20e7a0ef613eb7a06ee083f7ce21b'
'ac3e1d307756f5975587a7846500414c02d2b60acb271017b9c7aa6f47c89875'
'68f81b67dde5ee6003524b6b14e2d6f27edcfc0a2bde4c55a1cacbc6e299c207'
+ 'b93a1608aff32f4fad74decab836911d1592672b69e3b7a66a4fd28b7040db10'
'5631f224e90c4f0459361c2a5b250112e3a91ba849754bb6f67d69d683a2e5ac')
options=('!emptydirs')
@@ -36,6 +38,7 @@ prepare() {
patch -p1 -i ../395915dae1571e10e2766c999974de864655ea3a.patch
patch -p1 -i ../af0faf666c5008e54dfe43684f210e3581ff1bca.patch
patch -p1 -i ../0e9b286afe1224b91ff00936058b084ad4b776e4.patch
+ patch -p1 -R -i ../f83fb5f25263356391d71da595def409e8dd90f7.patch
}
build() {If that failed the following enables pam debugging. This will print very detailed information on pam processing to the console and journal.
diff --git a/trunk/PKGBUILD b/trunk/PKGBUILD
index d88c2bf..9933ee8 100644
--- a/trunk/PKGBUILD
+++ b/trunk/PKGBUILD
@@ -40,7 +40,7 @@ prepare() {
build() {
cd Linux-PAM-$pkgver
- ./configure --libdir=/usr/lib --sbindir=/usr/bin --disable-db
+ ./configure --libdir=/usr/lib --sbindir=/usr/bin --disable-db --enable-debug
make
}
Edit:
Fixed first diff
Last edited by loqs (2020-09-22 14:28:13)
Offline
@logs The patch did not fix the issue.
I also enabled debugging but can't see any real issues in dmesg or journalctl. Should I look for something specific?
Offline
In the journal there should be lots of extra entries from pam. Check the entries for pam_environment.
Edit:
You are installing the updated packages, after building them?
This is the pam_environment related output from a login with debug enabled on this system. You would see numerous lines of debug output on the console when logging in if pam debug was enabled.
[pam_env.c:pam_sm_open_session(867)] Called
[pam_env.c:handle_env(794)] Called.
[pam_env.c:_parse_config_file(134)] Called.
[pam_env.c:_parse_config_file(138)] Config file name is: /etc/security/pam_env.conf
[pam_env.c:_assemble_line(294)] called.
[pam_env.c:_parse_config_file(179)] Exit.
[pam_env.c:_parse_env_file(190)] Env file name is: /etc/environment
[pam_env.c:_assemble_line(294)] called.
[pam_env.c:_parse_env_file(276)] Exit.
[pam_env.c:_pam_get_item_byname(683)] Called.
[pam_env.c:_pam_get_item_byname(717)] Exit.
[pam_env.c:_parse_config_file(134)] Called.
[pam_env.c:_parse_config_file(138)] Config file name is: /home/testuser/.pam_environment
[pam_env.c:_assemble_line(294)] called.
[pam_env.c:_parse_config_file(155)] Read line: LONGVARIABLE DEFAULT=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
[pam_env.c:_parse_line(384)] Called buffer = <LONGVARIABLE DEFAULT=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
[pam_env.c:_parse_line(399)] var->name = <LONGVARIABLE>, length = 12
[pam_env.c:_parse_line(409)] DEFAULT=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
pam_env(systemd-user:session): pam_putenv: delete non-existent entry; xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
[pam_env.c:_parse_line(412)] Default arg found: <xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
[pam_env.c:_parse_line(460)] Exit.
[pam_env.c:_check_var(486)] Called.
[pam_env.c:_expand_arg(549)] Remember to initialize tmp!
[pam_env.c:_expand_arg(560)] Expanding <xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
[pam_env.c:_expand_arg(668)] Exit.
[pam_env.c:_check_var(521)] DEFAULT variable <LONGVARIABLE> being used: <xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
[pam_env.c:_check_var(529)] Exit.
[pam_env.c:_define_var(728)] Called.
[pam_env.c:_define_var(739)] Exit.
[pam_env.c:_assemble_line(294)] called.
[pam_env.c:_parse_config_file(155)] Read line: xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
[pam_env.c:_parse_line(384)] Called buffer = <xxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
[pam_env.c:_parse_line(399)] var->name = <xxxxxxxxxxxxxxxxxxxxxxxxxxxxx>, length = 29
[pam_env.c:_parse_line(460)] Exit.
[pam_env.c:_check_var(486)] Called.
[pam_env.c:_check_var(524)] UNDEFINE variable <xxxxxxxxxxxxxxxxxxxxxxxxxxxxx>
[pam_env.c:_check_var(529)] Exit.
[pam_env.c:_undefine_var(747)] Called and exit.
[pam_env.c:_assemble_line(294)] called.
[pam_env.c:_parse_config_file(179)] Exit.
[pam_env.c:handle_env(843)] Exit.Last edited by loqs (2020-09-23 17:24:35)
Offline
Yes. I installed it normally with makepkg. I don't think I saw entries like that, I'll have to recheck later. Are those entries supposed to be listed when running dmesg or elsewhere?
I'm using sudo -i to log in to my root user, if that makes a difference. su is disabled.
Last edited by sQVe (2020-09-23 17:30:12)
Offline
Using sudo -i, pam_sudo uses system-auth not system-login, so pam_environment is never executed with user_readenv=1.
The diff in post #10 reverting the change of default for user_readenv from 1 to 0 should have fixed that.
Offline
See if the issue is connected to the change to user_readenv:
My apologies. I forgot to force install with makepkg. Repatching and building does indeed fix the issues I'm having.
Running below still displays it as enabled though, confusing:
% rg readenv /etc/pam.d/system-login
19:session required pam_env.so user_readenv=1So I guess it's not enough to toggle that setting in system-login, and I need to run the patch instead.
Also, cheers for all the help and debugging @loqs!
Offline
pam_sudo uses system-auth not system-login, so pam_environment is never executed with user_readenv=1.
cat /etc/pam.d/sudo
#%PAM-1.0
auth include system-auth
account include system-auth
session include system-authEdit:
cat /etc/pam.d/system-auth
#%PAM-1.0
auth required pam_faillock.so preauth
# Optionally use requisite above if you do not want to prompt for the password
# on locked accounts.
auth [success=2 default=ignore] pam_unix.so try_first_pass nullok
-auth [success=1 default=ignore] pam_systemd_home.so
auth [default=die] pam_faillock.so authfail
auth optional pam_permit.so
auth required pam_env.so
auth required pam_faillock.so authsucc
# If you drop the above call to pam_faillock.so the lock will be done also
# on non-consecutive authentication failures.
-account [success=1 default=ignore] pam_systemd_home.so
account required pam_unix.so
account optional pam_permit.so
account required pam_time.so
-password [success=1 default=ignore] pam_systemd_home.so
password required pam_unix.so try_first_pass nullok shadow
password optional pam_permit.so
session required pam_limits.so
session required pam_unix.so
session optional pam_permit.soYou could change line 10 to add user_readenv=1 or at a new line at the end of session
session optional pam_env.so user_readenv=1Last edited by loqs (2020-09-23 20:06:19)
Offline
You could change line 10 to add user_readenv=1 or at a new line at the end of session
session optional pam_env.so user_readenv=1
Awesome. Thank you once again!
Offline