[SOLVED] Unable to login

[krotuss]

Hi,

after running emerge to update system I am no longer able to login into my raspberry 3. Simptoms are that pubkey ssh closes connection and terminal after short timeout period presents another login prompt. This is my second system that is affected, first was amd64 updated maybe 6 months ago and I still haven't got time to fix it. I suspect that there may be common cause. I am aware about:

2020-06-23-upgrade-to-sys-libs_pam-1_4_0
Title sys-libs/pam-1.4.0 upgrade
Author Mikle Kolyada <zlogene@gentoo.org>
Posted 2020-06-23
Revision 1

Starting with the 1.4.0 release [1], we don't offer these modules anymore:

* pam_tally and pam_tally2 have been deprecated and replaced
by the pam_faillock module
* pam_cracklib has been deprecated and replaced
by the pam_passwdqc module

These changes affected our basic PAM stack configuration.

You only need to take action if:
* you made manual changes to the PAM stack, or
* you use FEATURES="-config-protect-if-modified" option

If this applies to you, please make sure to either run the etc-update or
dispatch-conf command in order to sync your configuration.

Failure to do this may result in your system becoming inaccessible.

[1] - https://github.com/linux-pam/linux-pam/ ... tag/v1.4.0

But I don't think that this applies to me. Any suggestions? Thanks.

[alamahant]

Hi what happens if you ran

Code: Select all

emerge -1av sys-auth/pambase sys-libs/pam 
dispatch-conf
####replacing the old with the new configs

?
Then maybe re-emerge
openssh

[Banana]

@krotuss did a restart of ssh or even the system solve the issue?

[krotuss]

@alamahant: there is lot of blockers, seems that best option is to press on with world update.
@Banana: I have rebooted multiple times and I am still unable to login. In fact its possible that rebooting system before world update finished could have prevented its self recovery.

[Hu]

Are you able to get a root shell on the affected systems, whether through normal login or rescue media? If so, is there anything interesting in the system logs around the time that a failed login happened?

[nick_gentoo]

@alamahant: there is lot of blockers, seems that best option is to press on with world update.

The PAM update also hit me recently, but it's not yet clear that this is you problem.
In any case, I think it's worth trying first the suggestion of alamahant of running dispatch-conf (or etc-update); it should update the PAM config files, if that's what is blocking you.

By the way, are you using FEATURES="-config-protect-if-modified", mentioned in the news item?

[krotuss]

I was able to enable system logging and discovered that problem was caused by missing tally2 and cracklib so files. Although I don't have "-config-protect-if-modified" in my FEATURES. My hypothesis is that plugins and config files are owned by separate packages and plugins part got updated but config did not.

I have commented out lines that referenced missing plugins in /etc/pam.d and now I am able to login. I don't mean to assign blame, but maybe similar advice could have been part of news message. Or at least warning that if you lose access to your system (screenlocker!) you may not be able to re-login until update finishes and you will be left with no reliable way to tell if emerge is still running or not. Because of dependencies there is practically no way to update just specific packages so there is relatively high risk that some package may cause emerge to fail leaving user with bricked system.