please support systemd-homed about opendoas HOT 11 CLOSED

Thanks for the logs I will look into this further.

from opendoas.

This should work with pam.

from opendoas.

That said, I don't use systemd and I don't think I would personally want to add extra code for systemd.
It should work by default and sudo does nothing special either.

from opendoas.

do i need to add something to doas.conf? because right now it doesn't work

doas (tho@unix) password:
doas: Authorization failed

from opendoas.

Nothing except the rule to allow the username to use doas (not the uid, because with homed I assume it is not stable).
Just make sure its using pam, maybe compare the sudo and doas pam configuration in /etc/pam.d to see if your distribution enabled anything special in it to support systemd-homed

from opendoas.

my doas.conf is as follows

permit persist tho

/etc/pam.d/doas

#%PAM-1.0
auth            required        pam_unix.so
account         required        pam_unix.so
session         optional        pam_xauth.so
session         optional        pam_umask.so     usergroups umask=022
session         required        pam_env.so
session         required        pam_unix.so

/etc/pam.d/sudo

#%PAM-1.0
auth            include         system-auth
account         include         system-auth
session         include         system-auth

i don't understand how pam works at all, so i'm asking for your help. thank you for your time

from opendoas.

Maybe try something like the following for /etc/pam.d/doas:

#%PAM-1.0
auth            include         system-auth
account         include         system-auth
session         include         system-auth
session         optional        pam_umask.so     usergroups umask=022

This is the only difference I could think of, that the system-auth and other included pam configuration files hook in some systemd pam module to support systemd-homed.

If that doesn't work, you have to look at some logs regarding to pam to see if there is anything useful to investigate further.

from opendoas.

it says

doas: pam_close_session: Cannot make/remove an entry for the specified session

after a doas command

and here's an excerpt from dmesg

[ 2544.141020] audit: type=1101 audit(1591915068.437:220): pid=6128 uid=60047 auid=60047 ses=2 msg='op=PAM:accounting grantors=pam_systemd_home,pam_permit,pam_time acct="tho" exe="/usr/bin/doas" hostname=unix addr=? terminal=pts/0 res=success'
[ 2544.141416] audit: type=1103 audit(1591915068.437:221): pid=6128 uid=60047 auid=60047 ses=2 msg='op=PAM:setcred grantors=pam_systemd_home,pam_permit acct="root" exe="/usr/bin/doas" hostname=unix addr=? terminal=pts/0 res=success'
[ 2544.141640] audit: type=1105 audit(1591915068.437:222): pid=6128 uid=60047 auid=60047 ses=2 msg='op=PAM:session_open grantors=pam_limits,pam_systemd_home,pam_unix,pam_permit,pam_umask acct="root" exe="/usr/bin/doas" hostname=unix addr=? terminal=pts/0 res=success'
[ 2545.789696] audit: type=1106 audit(1591915070.087:223): pid=6128 uid=60047 auid=60047 ses=2 msg='op=PAM:session_close grantors=? acct="root" exe="/usr/bin/doas" hostname=unix addr=? terminal=pts/0 res=failed'

but it works!

from opendoas.

I'm unable to reproduce the issue, is this still happening for you @basedtho?

from opendoas.

unfortunately, i've stopped using doas, because it does not have a feature i need (Defaults rootpw)

from opendoas.

Ok then I'm closing this for now, if someone else runs into the issue please open a new one with more details.

from opendoas.