Unity Lockscreen in 14.04 can't unlock when using LDAP account
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
nss-pam-ldapd (Debian) |
Fix Released
|
Unknown
|
|||
nss-pam-ldapd (Ubuntu) |
Fix Released
|
High
|
Unassigned | ||
Trusty |
Fix Released
|
High
|
Unassigned | ||
Utopic |
Fix Released
|
High
|
Unassigned |
Bug Description
SRU justification:
[Impact]
* Summary: in Trusty, when libnss-ldapd is used, LDAP users are not able to unlock the Unity lockscreen. Utopic and later are not affected. Some workarounds are listed in comment #29.
* nslcd in Trusty and earlier does not permit unprivileged users to read shadow entries. When invoked by the Unity lockscreen, running as the logged-in user, pam_unix returns PAM_AUTHINFO_
* In Utopic and later, nslcd returns partial shadow entries to unprivileged users. This is enough for the expiry check in pam_unix to succeed, so the screen can be unlocked. See http://
* This proposed SRU backports the upstream solution to Trusty's nslcd. This is a change of behaviour for shadow queries from unprivileged users, compared to the current package. An alternative, more targeted fix would be to change Unity to ignore AUTHINFO_UNAVAIL results from pam_acct_mgmt, like gnome-screensaver already does (see comment #29). The nslcd change is a more general fix for not just Unity, but any PAM-using program run by an unprivileged user.
[Test Case]
* Install and configure libnss-ldapd. Ensure ldap is enabled for at least the passwd and shadow services in /etc/nsswitch.conf.
* Log into Unity as an LDAP user, lock the screen, and then try to unlock it again.
[Regression Potential]
* The patch is minimal, was written by the upstream author, and was backported (adjusting for whitespace changes) to Trusty. The change has already been released in Utopic and will be included in Debian Jessie as well.
* Regression testing should include checking that shadow queries, both by name and for listing all users, are unchanged when issued as root.
[Other Info]
* Packages for testing are available in ppa:rtandy/
Original description:
My setup is:
Ubuntu 14.04 LTS,
ldap accounts,
krb5 authentication,
Lightdm,
Unity session
ldap+krb5 is configured using nss-ldapd and nslcd. It works fine. getent passwd and getent shadow works fine.
I am able to login in console without any problems.
I was able to login in lightdm.
Then I used the lock screen.
I could not disable the lock screen using my password.
I rebooted my computer.
Now:
After logging in through lightdm, the unity lockscreen locks the screen immediately and I can not disable it using my password.
From my short inspection of auth.log and unix_chkpwd sources it seems, that unix_chkpwd works fine when called from lightdm and fails to get user info when called from unity lockscreen.
lsb_release -rd
Description: Ubuntu 14.04 LTS
Release: 14.04
apt-cache policy unity lightdm libpam-modules
unity:
Installed: 7.2.0+14.
Candidate: 7.2.0+14.
Version table:
*** 7.2.0+14.
500 http://
100 /var/lib/
lightdm:
Installed: 1.10.0-0ubuntu3
Candidate: 1.10.0-0ubuntu3
Version table:
*** 1.10.0-0ubuntu3 0
500 http://
100 /var/lib/
libpam-modules:
Installed: 1.1.8-1ubuntu2
Candidate: 1.1.8-1ubuntu2
Version table:
*** 1.1.8-1ubuntu2 0
500 http://
100 /var/lib/
Contents of /var/log/auth.log:
Apr 29 06:49:27 localhost lightdm: pam_succeed_
Apr 29 06:49:31 localhost lightdm: pam_unix(
Apr 29 06:49:31 localhost lightdm: pam_krb5(
Apr 29 06:49:32 localhost lightdm[15604]: pam_unix(
Apr 29 06:49:37 localhost unix_chkpwd[15825]: check pass; user unknown
Apr 29 06:49:37 localhost unix_chkpwd[15825]: password check failed for user (user)
Apr 29 06:49:37 localhost compiz: pam_unix(
Apr 29 06:49:37 localhost compiz: pam_krb5(
Apr 29 06:49:37 localhost unix_chkpwd[15826]: could not obtain user info (user)
Apr 29 06:49:37 localhost unix_chkpwd[15827]: could not obtain user info (user)
Apr 29 06:49:37 localhost compiz: pam_succeed_
cat /etc/pam.
account required pam_unix.so
auth required pam_group.so
auth [success=2 default=ignore] pam_unix.so try_first_pass nullok_secure
auth [success=1 default=ignore] pam_krb5.so try_first_pass minimum_uid=200
auth requisite pam_deny.so
auth required pam_permit.so
auth optional pam_afs_session.so minimum_uid=200
auth optional pam_ecryptfs.so unwrap
auth optional pam_cap.so
cat /etc/pam.
account required pam_unix.so
cat /etc/pam.d/lightdm
auth requisite pam_nologin.so
auth sufficient pam_succeed_if.so user ingroup nopasswdlogin
@include common-auth
auth optional pam_gnome_
@include common-account
session [success=ok ignore=ignore module_
auth optional pam_group.so
session required pam_limits.so
@include common-session
session [success=ok ignore=ignore module_
session optional pam_gnome_
session required pam_env.so readenv=1
session required pam_env.so readenv=1 user_readenv=1 envfile=
@include common-password
Changed in unity (Ubuntu): | |
importance: | Undecided → High |
Changed in unity: | |
importance: | Undecided → High |
status: | New → Confirmed |
Changed in nss-pam-ldapd (Debian): | |
status: | Unknown → Fix Released |
Changed in unity: | |
status: | Confirmed → Invalid |
Changed in unity (Ubuntu): | |
status: | Confirmed → Invalid |
Changed in nss-pam-ldapd (Ubuntu Utopic): | |
status: | New → Fix Released |
Changed in nss-pam-ldapd (Ubuntu): | |
status: | Confirmed → Fix Released |
Changed in unity (Ubuntu Trusty): | |
status: | New → Invalid |
Changed in unity (Ubuntu Utopic): | |
status: | New → Invalid |
affects: | unity → ubuntu-translations |
no longer affects: | ubuntu-translations |
no longer affects: | unity (Ubuntu) |
no longer affects: | unity (Ubuntu Utopic) |
no longer affects: | unity (Ubuntu Trusty) |
Changed in nss-pam-ldapd (Ubuntu Utopic): | |
importance: | Undecided → High |
Changed in nss-pam-ldapd (Ubuntu Trusty): | |
importance: | Undecided → High |
Changed in nss-pam-ldapd (Ubuntu): | |
importance: | Undecided → High |
Status changed to 'Confirmed' because the bug affects multiple users.