[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
bug#52533: guix deploy breaks SSH access with a PAM error
From: |
Ludovic Courtès |
Subject: |
bug#52533: guix deploy breaks SSH access with a PAM error |
Date: |
Thu, 13 Jan 2022 16:04:15 +0100 |
User-agent: |
Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux) |
Hi,
Mathieu Othacehe <othacehe@gnu.org> skribis:
>> This sounds a lot like this:
>>
>> https://issues.guix.gnu.org/32182#1
>
> I was just kicked out of my own server due to this PAM/SSH issue. It
> happens quite frequently here. Time for a fix :).
Note that ‘guix deploy’ now opens a single SSH session, starting from
7f20e59a13a6acc3331e04185b8f1ed2538dcd0a, which might help mitigate the
problem.
> Regarding the two potential solutions that you proposed in 2018, are
> they still actual? If yes, I could maybe try to implement the second
> suggestion: introducing service chain-loading.
Service chain-loading was implemented in the Shepherd a few years ago.
However, it doesn’t really help; consider these two scenario:
• You do ‘guix system reconfigure && herd restart term-tty1’. In that
case, all is good: ‘term-tty1’, will run the new ‘mingetty’ process
(post-glibc upgrade, thanks to service chain-loading) and ‘login’
will happily load the .so files listed in /etc/pam.d/login (also
post-glibc upgrade).
• You run ‘guix system reconfigure’ but do not restart ‘term-tty1’,
‘sshd’, and all the other services that depend on PAM: these
pre-glibc upgrade programs will try dlopening the post-glibc upgrade
PAM plugins, which will break.
The crux of the problem rather is the global /etc/pam.d: it’s valid for
pre-glibc upgrade programs, or for post-glibc upgrade programs, but not
both.
FHS distros have a similar problem though; how do they handle it? Do
they force services to be restarted when glibc is upgraded, or something
along these lines?
In our case, suppose libpam honors $PAM_DIRECTORY; we could tweak each
PAM-using Shepherd service (login, sshd, etc.) so that it sets
PAM_DIRECTORY… but how would we get the PAM_DIRECTORY value for the OS
being configured? Tricky!
We could maybe sidestep the issue altogether with socket-activated
services: they’d be started on-demand, so the second scenario above
would be unlikely. But getting there is quite a bit of work…
Ludo’.
- bug#52533: guix deploy breaks SSH access with a PAM error, Mathieu Othacehe, 2022/01/13
- bug#52533: guix deploy breaks SSH access with a PAM error, Mathieu Othacehe, 2022/01/13
- bug#52533: guix deploy breaks SSH access with a PAM error,
Ludovic Courtès <=
- bug#52533: guix deploy breaks SSH access with a PAM error, Maxim Cournoyer, 2022/01/13
- bug#52533: guix deploy breaks SSH access with a PAM error, Ludovic Courtès, 2022/01/17
- bug#52533: guix deploy breaks SSH access with a PAM error, Maxim Cournoyer, 2022/01/17
- bug#52533: guix deploy breaks SSH access with a PAM error, Ludovic Courtès, 2022/01/17
- bug#52533: guix deploy breaks SSH access with a PAM error, Maxim Cournoyer, 2022/01/17
- bug#52533: guix deploy breaks SSH access with a PAM error, Ludovic Courtès, 2022/01/18