Users-admin unlock not working

[Phoul]

Binary package hint: gnome-system-tools

Unlocking Users-admin does not work

ProblemType: Bug
Architecture: i386
Date: Wed Jan 16 20:04:59 2008
DistroRelease: Ubuntu 8.04
ExecutablePath: /usr/bin/users-admin
NonfreeKernelModules: nvidia
Package: gnome-system-tools 2.21.5.1-0ubuntu1
PackageArchitecture: i386
ProcCmdline: users-admin
ProcCwd: /home/phoul
ProcEnviron:
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
 LANG=C
 SHELL=/bin/bash
SourcePackage: gnome-system-tools
Uname: Linux zomgbox 2.6.24-4-generic #1 SMP Mon Jan 14 17:30:39 UTC 2008 i686 GNU/Linux

[Sebastien Bacher (seb128)]

Thank you for your bug. Your bug lacks details to be useful, how it doesn't work? Does it display an error messages? Which one? Does it ask for a password? Do the other admin tools work correctly?

[Phoul (v-admin-insecure-complexity-com)]

When i hit unlock it tells me it could not authenticate, It doesnt ask me to enter a password at all. Some people in the #ubuntu+1 were saying its because the policy kit broke in the latest update, Im not sure how accurate that is but it was just a thought.

[Phoul (v-admin-insecure-complexity-com)]

This is for Hardy Heron by the way, I just noticed i didnt specifiy that.

[Emilio Pozuelo Monfort (pochu)]

I get the same, with every *-admin binary:

17:49 < pochu> pitti, seb128: with latest g-s-t and PK I can't authenticate into *-admin. I get a popup saying "An unexpected error has occurred.", and **
                   (services-admin:24487): CRITICAL **: Unable to lookup exe for caller

Not sure if this is g-s-t or PK's fault, as this was working before upgrading PK to 0.7

[Carlos Garnacho (carlosg)]

g-s-t has nothing to do with that, that's an error returned from PK that g-s-t prints now, looks like bug #181088 has revived?

[Phoul (v-admin-insecure-complexity-com)]

Yes, It looks very similar if not identicle, I guess the issue with the policy kits has come back

[Gabriel Speckhahn (gabspeck)]

Is anyone else experiencing trouble running the other system tools as well? users-admin and network-admin run fine, but for the other g-s-t, here's what I get:

$ time-admin

(time-admin:6832): Gtk-WARNING **: <accessibility> is being ignored,
see http://bugzilla.gnome.org/show_bug.cgi?id=454653

(time-admin:6832): Gtk-WARNING **: Unknown property: GtkCalendar.display-options
Segmentation fault

$ shares-admin

(shares-admin:6983): Gtk-WARNING **: Unknown property: GtkComboBox.items

Segmentation fault

$ services-admin
Segmentation fault

[Gabriel Speckhahn (gabspeck)]

**users-admin and network-admin run with this Unlock bug by the way, but they show up on the screen.

[Martin Pitt (pitti)]

Do you have policykit-gnome 0.6 or 0.7? It will not work with 0.6. The 0.7 binaries were stuck in the NEW queue until a few hours ago.

[Emilio Pozuelo Monfort (pochu)]

As Sebastien pointed out on IRC, this could be because of having policykit 0.7 with policykit-gnome 0.6. That's what I have right now, and it's broken. I've just upgraded policykit-gnome to 0.7 and it fixes this bug.

[Martin Pitt (pitti)]

policykit (0.7-2ubuntu2) hardy; urgency=low

  * Add Breaks: policykit-gnome (<< 0.7). (LP: #183673)

 -- Martin Pitt <email address hidden> Thu, 17 Jan 2008 23:13:29 +0100

[sub (sub-linpro)]

I have the same problem.
But:

root@Rage:/srv/nfs/drift/home/sub# dpkg -l policykit*
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Installed/Config-f/Unpacked/Failed-cfg/Half-inst/t-aWait/T-pend
|/ Err?=(none)/Hold/Reinst-required/X=both-problems (Status,Err: uppercase=bad)
||/ Name Version Description
+++-===========================================-===========================================-======================================================================================================
ii policykit 0.7-2ubuntu7 framework for managing administrative policies and privileges
ii policykit-gnome 0.7-2ubuntu1 GNOME dialogs for PolicyKit
root@Rage:/srv/nfs/drift/home/sub#

That's a pain in the ass when you have to connect to a customer vpn to fix a problem fast :)

[Matt Grice (mattgrice)]

After a recent 'update-manager -c' to Hardy, I'm now getting the same error.

I'm running policykit v0.7 btw.

Matt

[oxyk (djoxyk)]

the same here
updated to 8.04 from 7.10
network-admin is locked or crashed (sudo can't open it), unlock button greyed all the time
eth0 have no mac address and work in roaming mode, firewall have open ports (i've tried 3 firewalls, looks like iptables don't care), local network spamming and i can't stop it.
when i try to open ppoe or eth0 config in network manager - it tell me that device is not found.
but i have internet

And it's when my 7.10 was tuned and works perfectly :(

how to unlock that interfaces and protect my computer?
i have this policykit installed:

ii policykit 0.7-2ubuntu7 framework for managing administrative policies and privileges
ii policykit-gnome 0.7-2ubuntu1 GNOME dialogs for PolicyKit

[Martin Pitt (pitti)]

Matt, oxyk, it sounds like you don't have a ConsoleKit session? Can you please give the output of the following commands (in a terminal)

  ck-list-sessions
  pidof hald

Thanks!

[oxyk (djoxyk)]

I've got this output:

oxyk@top:~$ ck-list-sessions
Session1:
        uid = '1000'
        realname = 'oxyk'
        seat = 'Seat1'
        session-type = ''
        active = TRUE
        x11-display = ':0'
        x11-display-device = '/dev/tty7'
        display-device = ''
        remote-host-name = ''
        is-local = TRUE
        on-since = '2008-05-08T17:22:57Z'
oxyk@top:~$ pidof hald
6923

---
I'm the only user and distro was updated from 7.10 via internet (not fresh installation). It's KDE 4.x - maybe problem in updates. I still can't unlock network coniguration and services. Buttons are grey.

oxyk@top:~$ sudo network-admin
(network-admin:8100): Gtk-WARNING **: Unknown property: GtkComboBox.items
** (network-admin:8100): CRITICAL **: Unable to lookup session information for process '8100'

[Lam Nguyen Ngoc (lam.iffvn)]

I have fixed this bug after run this command:
$ sudo apt-get install policykit-gnome

[Martin Pitt (pitti)]

gnome-mount has a hard dependency on policykit-gnome, so I don't see what I should fix here. Did you forcefully remove that package manually?

This bug report is already closed, and should still be (your issue is unrelated). So if you think that there is a problem which we need to fix, can you please report a new bug?

[Jean-Noel Rey (jnrey)]

Have you checked /etc/hosts. With hardy, the initial entry was something like:

127.0.0.1 localhost
127.0.1.1 aaa.bbb.com

when it should be

127.0.0.1 localhost
127.0.1.1 aaa.bbb.com <name of machine, e.g. ubuntu>

This solved it for me.

[johanseland (johan-seland)]

I can confirm that this bug is still present on a freshly installed headless Hardy amd64-machine.

When logging in remotely, using ssh -X, I am not able to click the "Unlock" button when starting users-admin

jse@triplex:~$ ck-list-sessions
Session2:
 uid = '1004'
 realname = 'Johan Simon Seland,,,'
 seat = 'Seat3'
 session-type = ''
 active = TRUE
 x11-display = 'localhost:10.0'
 x11-display-device = ''
 display-device = '/dev/pts/0'
 remote-host-name = 'jse-desktop.local'
 is-local = FALSE
 on-since = '2008-05-28T08:10:39Z'

[Gilbert Mendoza (gmendoza)]

Just ran into this bug. Clean installation of Ubuntu Desktop 8.04.

Running "users-admin" from console works as expected.
Running "users-admin" or "sudo users-admin" from remote connection (e.g. ssh X11 forwarding, NXClient, etc) does not allow administrative access to unlock the tool.

The error given is:
** (users-admin:9673): CRITICAL **: Unable to lookup session information for process '9673'

"ck-list-sessions" output below shows minor differences between a local and remote session.

Session1:
 uid = '1000'
 realname = 'Gilbert Mendoza,,,'
 seat = 'Seat1'
 session-type = ''
 active = TRUE
 x11-display = ':0'
 x11-display-device = '/dev/tty7'
 display-device = ''
 remote-host-name = ''
 is-local = TRUE
 on-since = '2008-05-29T16:48:47Z'
 idle-since-hint = '2008-05-29T17:09:07Z'
Session3:
 uid = '1000'
 realname = 'Gilbert Mendoza,,,'
 seat = 'Seat3'
 session-type = ''
 active = TRUE
 x11-display = 'localhost:10.0'
 x11-display-device = ''
 display-device = '/dev/pts/0'
 remote-host-name = 'hostnamewashere.local'
 is-local = FALSE
 on-since = '2008-05-29T21:10:32Z'

[[e-mail] (prennix)]

I'm seeing this as well. 8.04 latest updates as of 6/16

"could not authenticate" when trying to unlock network manager via local session. latest policykit-gnome installed..

[toniiv (toniivars)]

Hello, I've fixed this issue on my Hardy by adding my user to the "admin" group.

First check your groups with following command: "$ id"
If 122(admin) is not in your list, then edit /etc/group as root and add your login name at the end of line "admin:x:122:"
Save changes an finally restart session.

[Roger Kober (roger-kober)]

Maybe a configuration isssue on my machine (Hardy on VMware):
    - It works if I logon from VMWare Virtual Infrastructure Client
    - It doesn't work if I logon with NoMachine client
   - It doesn't work if I logon via ssh and forwarding X to my Window machine

Works as designed - from local session is permitted from remote is not?
If this is true:
    - Shouldn't there a hint that remote administration is not allowed?
    - Where is the switch to allow from remote?

[Martin Pitt (pitti)]

Roger Kober [2008-07-01 7:36 -0000]:
> Maybe a configuration isssue on my machine (Hardy on VMware):
> - It works if I logon from VMWare Virtual Infrastructure Client
> - It doesn't work if I logon with NoMachine client
> - It doesn't work if I logon via ssh and forwarding X to my Window machine
>
> Works as designed - from local session is permitted from remote is not?

Exactly. Remote sessions do not get a ConsoleKit entry (since they are
not on a physical console), and g-s-t currently does not allow
administration from remote places [1]

You should be able to change that using System -> Administration ->
Authorizations, freedesktop -> systemtoolsbackends -> Manage system
configuration, Edit, allow for anyone (Admin authentication).

[1] /usr/share/PolicyKit/policy/system-tools-backends.policy

[Gilbert Mendoza (gmendoza)]

Martin Pitt wrote:
> You should be able to change that using System -> Administration ->
> Authorizations, freedesktop -> systemtoolsbackends -> Manage system
> configuration, Edit, allow for anyone (Admin authentication).

Awesome... this worked for me. Tested with SSH forwarding, and I am now
able to click on the "unlock" button from a remote location.

Thanks!

[Joe Parks (jplpu)]

Martin Pitt wrote:
> You should be able to change that using System -> Administration ->
> Authorizations, freedesktop -> systemtoolsbackends -> Manage system
> configuration, Edit, allow for anyone (Admin authentication).

Unfortunately this did *not* work for me. I tested with NoMachine client and the "unlock" button
is still grayed out. I also tried changing policy allowing reboots with no luck. Perhaps NoMachine
isn't considered "anyone"?

[Roger Kober (roger-kober)]

2008/7/2 Joe Parks <email address hidden>:

> Martin Pitt wrote:
> > You should be able to change that using System -> Administration ->
> > Authorizations, freedesktop -> systemtoolsbackends -> Manage system
> > configuration, Edit, allow for anyone (Admin authentication).
>
> Unfortunately this did *not* work for me. I tested with NoMachine client
> and the "unlock" button
> is still grayed out. I also tried changing policy allowing reboots with no
> luck. Perhaps NoMachine
> isn't considered "anyone"?

Same here:
Works with putty (ssh client) and Xming (X server for Windows) but not with
NoMachine (on Windows XP)

[Gilbert Mendoza (gmendoza)]

Sorry folks... I misspoke. NoMachine does not work for me either.
I'm still investigating.

A cheesy workround until then is to "ssh -XC localhost" from the
NoMachine session.

--
Gilbert Mendoza
PGP: 0x075DBCA9
Email: gmendoza at gmail.com
http://www.savvyadmin.com
https://launchpad.net/~gmendoza
https://wiki.ubuntu.com/GilbertMendoza

On Wed, Jul 2, 2008 at 9:36 AM, Roger Kober <email address hidden> wrote:
> 2008/7/2 Joe Parks <email address hidden>:
>> Unfortunately this did *not* work for me. I tested with NoMachine client
>> and the "unlock" button
>> is still grayed out. I also tried changing policy allowing reboots with no
>> luck. Perhaps NoMachine
>> isn't considered "anyone"?
>
> Same here:
> Works with putty (ssh client) and Xming (X server for Windows) but not with
> NoMachine (on Windows XP)

[Archer (fritsche-markus)]

-----
ii policykit 0.7-2ubuntu7
ii policykit-gnome 0.7-2ubuntu1.1
-----
network-admin

** (network-admin:6571): CRITICAL **: Launch helper exited with unknown return code 127
-----
id
uid=1000(mfritsche) gid=1000(mfritsche) Gruppen=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),107(fuse),109(lpadmin),115(admin),1000(mfritsche)
-----
(Unlock Button doesn't work with "unexpected error" msg). I tried all fixes suggested here, and I am on a local session.

[Archer (fritsche-markus)]

-----
mfritsche@eeepc:~$ polkit-gnome-authorization
polkit-gnome-authorization: error while loading shared libraries:a: cannot open shared object file: No such file or directory
-----
Linux eeepc 2.6.24-16-generic #1 SMP Thu Apr 10 13:23:42 UTC 2008 i686 GNU/Linux
-----
Ubuntu Hardy Heron

[ski (skibrianski)]

I'm having the same problem where users-admin applet doesn't start -- looks like polkit-gnome-authorization is actually segfaulting. amd64 here.

ski@deskaheh:~/Desktop$ cat /proc/version
Linux version 2.6.24-19-generic (buildd@king) (gcc version 4.2.3 (Ubuntu 4.2.3-2ubuntu7)) #1 SMP Wed Aug 20 17:53:40 UTC 2008

ski@deskaheh:~/Desktop$ polkit-gnome-authorization

** (polkit-gnome-authorization:32216): CRITICAL **: dbus_g_connection_get_connection: assertion `gconnection' failed
process 32216: arguments to dbus_connection_send() were incorrect, assertion "connection != NULL" failed in file dbus-connection.c line 3081.
This is normally a bug in some application using the D-Bus library.

** (polkit-gnome-authorization:32216): CRITICAL **: dbus_g_connection_get_connection: assertion `gconnection' failed
process 32216: arguments to dbus_connection_send() were incorrect, assertion "connection != NULL" failed in file dbus-connection.c line 3081.
This is normally a bug in some application using the D-Bus library.
Segmentation fault

[ski (skibrianski)]

Update: after restarting dbus and gdm, the problem has gone away. I have a sneaking suspicion this is related to using NX with the same user as a login session at least in my case. If I log in to nx before the console, I also get a message about HAL not being able to initialize. When this message doesn't appear, it seems, the problem doesn't exist. Details at 11...

[oxyk (djoxyk)]

I don't know if it's accidentally, but when I have installed xfce and run it on the same ubuntu installation - unlock worked for me without any glitch (so I'veconfigured my connection from xfce actually).
Once I've load KDE 4.x - it does not work. I've applied all updates till 8.10.
Now I've moved to the new PC and installed _64 ubuntu. Unlock by itself works (standard gnome desktop), but the pppoe connection can't be selected in network manager (once clicked, it blink and become passive) - i don't know if it related to policy-kit somehow, or it's _64 issue. I did not found any info about this strage behaviour (live cd has been working with internet before installation)

[Alex Bennée (ajbennee)]

What package update is meant to have fixed this. I have the same problem that the "Unlock" button is greyed out for most of the admin tools when I access the server with "ssh -Y" and "vncviewer". The suggested work around (#26) doesn't seem to have any effect.

Obviously it's a bit crippling not being able to configure the server remotely as it spends it's time in a remote data centre.

The ck-list-sessions output shows:

vnms@vnms:~$ ck-list-sessions
Session1:
 uid = '1000'
 realname = 'VectaStar Network Manager,,,'
 seat = 'Seat2'
 session-type = ''
 active = TRUE
 x11-display = 'localhost:10.0'
 x11-display-device = ''
 display-device = '/dev/pts/0'
 remote-host-name = '10.0.0.166'
 is-local = FALSE
 on-since = '2009-10-05T16:28:00Z'

vnms@vnms:~$ uname -a
Linux vnms 2.6.24-24-server #1 SMP Sat Aug 22 00:59:57 UTC 2009 x86_64 GNU/Linux

[mexlinux (mcanedo)]

This is still present in Intrepid