Comments (11)
Thanks for the logs I will look into this further.
from opendoas.
This should work with pam.
from opendoas.
That said, I don't use systemd and I don't think I would personally want to add extra code for systemd.
It should work by default and sudo does nothing special either.
from opendoas.
do i need to add something to doas.conf? because right now it doesn't work
doas (tho@unix) password:
doas: Authorization failed
from opendoas.
Nothing except the rule to allow the username to use doas (not the uid, because with homed I assume it is not stable).
Just make sure its using pam, maybe compare the sudo and doas pam configuration in /etc/pam.d
to see if your distribution enabled anything special in it to support systemd-homed
from opendoas.
my doas.conf is as follows
permit persist tho
/etc/pam.d/doas
#%PAM-1.0
auth required pam_unix.so
account required pam_unix.so
session optional pam_xauth.so
session optional pam_umask.so usergroups umask=022
session required pam_env.so
session required pam_unix.so
/etc/pam.d/sudo
#%PAM-1.0
auth include system-auth
account include system-auth
session include system-auth
i don't understand how pam works at all, so i'm asking for your help. thank you for your time
from opendoas.
Maybe try something like the following for /etc/pam.d/doas
:
#%PAM-1.0
auth include system-auth
account include system-auth
session include system-auth
session optional pam_umask.so usergroups umask=022
This is the only difference I could think of, that the system-auth and other included pam configuration files hook in some systemd pam module to support systemd-homed.
If that doesn't work, you have to look at some logs regarding to pam to see if there is anything useful to investigate further.
from opendoas.
it says
doas: pam_close_session: Cannot make/remove an entry for the specified session
after a doas command
and here's an excerpt from dmesg
[ 2544.141020] audit: type=1101 audit(1591915068.437:220): pid=6128 uid=60047 auid=60047 ses=2 msg='op=PAM:accounting grantors=pam_systemd_home,pam_permit,pam_time acct="tho" exe="/usr/bin/doas" hostname=unix addr=? terminal=pts/0 res=success'
[ 2544.141416] audit: type=1103 audit(1591915068.437:221): pid=6128 uid=60047 auid=60047 ses=2 msg='op=PAM:setcred grantors=pam_systemd_home,pam_permit acct="root" exe="/usr/bin/doas" hostname=unix addr=? terminal=pts/0 res=success'
[ 2544.141640] audit: type=1105 audit(1591915068.437:222): pid=6128 uid=60047 auid=60047 ses=2 msg='op=PAM:session_open grantors=pam_limits,pam_systemd_home,pam_unix,pam_permit,pam_umask acct="root" exe="/usr/bin/doas" hostname=unix addr=? terminal=pts/0 res=success'
[ 2545.789696] audit: type=1106 audit(1591915070.087:223): pid=6128 uid=60047 auid=60047 ses=2 msg='op=PAM:session_close grantors=? acct="root" exe="/usr/bin/doas" hostname=unix addr=? terminal=pts/0 res=failed'
but it works!
from opendoas.
I'm unable to reproduce the issue, is this still happening for you @basedtho?
from opendoas.
unfortunately, i've stopped using doas, because it does not have a feature i need (Defaults rootpw
)
from opendoas.
Ok then I'm closing this for now, if someone else runs into the issue please open a new one with more details.
from opendoas.
Related Issues (20)
- [Feature Request] Adding `askpass` Support HOT 3
- `question:` How to run nobody under root ? HOT 2
- Failed to power off system via logind: Interactive authentication required. HOT 1
- security vulnerability: TIOCSTI tty character injection HOT 20
- Cross compiling is broken
- Permit with variable arguments
- FreeBSD persist support? HOT 1
- zsh completions? HOT 1
- Document the intended behavior of persist.
- `go build` fails when using `doas` HOT 4
- Pull request adding GitHub Actions CI welcome? HOT 1
- Show asterisks while typing. HOT 2
- arguments not passed HOT 3
- wrong shell HOT 10
- Incorrect ordering of paths in safepath HOT 2
- [Question] Is OpenDoas support SELinux? HOT 1
- compare strings in constant time
- doas doesn't work with [[ in bash HOT 1
- timestamp create predictible path HOT 3
- doas prints pam conversation to stdout HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from opendoas.