Your message dated Thu, 28 Jun 2018 19:19:45 +0000 with message-id <[email protected]> and subject line Bug#898519: fixed in pam-u2f 1.0.7-1 has caused the Debian Bug report #898519, regarding libpam-u2f: upgrade to 1.0.6 breaks authentication with u2fzero device to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 898519: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=898519 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: libpam-u2f Version: 1.0.6-1 Severity: important Dear Maintainer, during a system upgrade on buster the package libpam-u2f is upgraded from 1.0.4 to 1.0.6. After the upgrade the PAM modules fails to authenticate with the U2Fzero device (u2fzero.com). A manual downgrade to 1.0.4 solves all issues. This is severe: if the system is rebooted directly, authentication would fail. The user would be locked out from machine. A quick look at the code shows a lot changes between the two (minor) versions. But i couldn't figure out the exact lines involved yet. While with the 1.0.4 version the u2f device shows a red light as signal for pressing the button, the 1.0.6 version makes the device just light up bright green. My Configuration files: /etc/pam.d/u2f: auth required pam_u2f.so authfile=/etc/u2f_keys cue debug openasuser /etc/pam.d/sudo: #%PAM-1.0 @include common-auth @include common-account @include common-session-noninteractive @include u2f Output with debug option enabled: jkur@durruti:~$ sudo su [sudo] Passwort für jkur: [../pam-u2f.c:parse_cfg(64)] called. [../pam-u2f.c:parse_cfg(65)] flags 32768 argc 3 [../pam-u2f.c:parse_cfg(67)] argv[0]=authfile=/etc/u2f_keys [../pam-u2f.c:parse_cfg(67)] argv[1]=cue [../pam-u2f.c:parse_cfg(67)] argv[2]=debug [../pam-u2f.c:parse_cfg(68)] max_devices=0 [../pam-u2f.c:parse_cfg(69)] debug=1 [../pam-u2f.c:parse_cfg(70)] interactive=0 [../pam-u2f.c:parse_cfg(71)] cue=1 [../pam-u2f.c:parse_cfg(72)] manual=0 [../pam-u2f.c:parse_cfg(73)] nouserok=0 [../pam-u2f.c:parse_cfg(74)] alwaysok=0 [../pam-u2f.c:parse_cfg(75)] authfile=/etc/u2f_keys [../pam-u2f.c:parse_cfg(76)] origin=(null) [../pam-u2f.c:parse_cfg(77)] appid=(null) [../pam-u2f.c:pam_sm_authenticate(119)] Origin not specified, using "pam://durruti" [../pam-u2f.c:pam_sm_authenticate(130)] Appid not specified, using the same value of origin (pam://durruti) [../pam-u2f.c:pam_sm_authenticate(140)] Maximum devices number not set. Using default (24) [../pam-u2f.c:pam_sm_authenticate(158)] Requesting authentication for user jkur [../pam-u2f.c:pam_sm_authenticate(169)] Found user jkur [../pam-u2f.c:pam_sm_authenticate(170)] Home directory for jkur is /home/jkur [../pam-u2f.c:pam_sm_authenticate(221)] Using authentication file /etc/u2f_keys [../util.c:get_devices_from_authfile(107)] Authorization line: jkur:bz1_psgGoVqj7EF6woABHuu4FSQ_oTJz_5zwzE-mIm_KRib_,047d360b8d4c2077430d1c42ff0f39788ec45e805bdc95a8f6b645d781ac00056b19289a9a1519bdbe94de5f7e4a98858811e7e09e34d4c51763287bd9d971134d [../util.c:get_devices_from_authfile(112)] Matched user: jkur [../util.c:get_devices_from_authfile(130)] KeyHandle for device number 1: bz1_psgGoVqj7EF6woABHuu4FSQ_oTJz_5zwzE-mIm_KRib_ [../util.c:get_devices_from_authfile(157)] publicKey for device number 1: 047d360b8d4c2077430d1c42ff0f39788ec45e805bdc95a8f6b645d781ac00056b19289a9a1519bdbe94de5f7e4a98858811e7e09e34d4c51763287bd9d971134d [../util.c:get_devices_from_authfile(172)] Length of key number 1 is 65 [../util.c:get_devices_from_authfile(200)] Found 1 device(s) for user jkur Please touch the device. [../util.c:do_authentication(262)] Device max index is 0 [../util.c:do_authentication(288)] Attempting authentication with device number 1 [../util.c:do_authentication(310)] Challenge: { "keyHandle": "bz1_psgGoVqj7EF6woABHuu4FSQ_oTJz_5zwzE-mIm_KRib_", "version": "U2F_V2", "challenge": "frqCM5S0XEXkVNKHoRD96P9jVFLmDI0M-jdLWb_kK0U", "appId": "pam:\/\/durruti" } [../util.c:do_authentication(316)] Response: { "signatureData": "AQAAAcgwRQIgRoPNq_hryxmrH6m2VWM5ANsHptaUTefUmUEjtKehr_gCIQDHVex3x3XYKQfXBbTGGDndLklGbh80DkEHff2e9KvKbA", "clientData": "eyAiY2hhbGxlbmdlIjogImZycUNNNVMwWEVYa1ZOS0hvUkQ5NlA5alZGTG1ESTBNLWpkTFdiX2tLMFUiLCAib3JpZ2luIjogInBhbTpcL1wvZHVycnV0aSIsICJ0eXAiOiAibmF2aWdhdG9yLmlkLmdldEFzc2VydGlvbiIgfQ", "keyHandle": "bz1_psgGoVqj7EF6woABHuu4FSQ_oTJz_5zwzE-mIm_KRib_" } [../pam-u2f.c:pam_sm_authenticate(275)] done. [Erfolg] root@durruti:/home/jkur# root@durruti:/home/jkur# root@durruti:/home/jkur# root@durruti:/home/jkur# exit jkur@durruti:~$ sudo su [sudo] Passwort für jkur: debug(pam_u2f): ../pam-u2f.c:89 (parse_cfg): called. debug(pam_u2f): ../pam-u2f.c:90 (parse_cfg): flags 32768 argc 4 debug(pam_u2f): ../pam-u2f.c:92 (parse_cfg): argv[0]=authfile=/etc/u2f_keys debug(pam_u2f): ../pam-u2f.c:92 (parse_cfg): argv[1]=cue debug(pam_u2f): ../pam-u2f.c:92 (parse_cfg): argv[2]=debug debug(pam_u2f): ../pam-u2f.c:92 (parse_cfg): argv[3]=openasuser debug(pam_u2f): ../pam-u2f.c:94 (parse_cfg): max_devices=0 debug(pam_u2f): ../pam-u2f.c:95 (parse_cfg): debug=1 debug(pam_u2f): ../pam-u2f.c:96 (parse_cfg): interactive=0 debug(pam_u2f): ../pam-u2f.c:97 (parse_cfg): cue=1 debug(pam_u2f): ../pam-u2f.c:98 (parse_cfg): manual=0 debug(pam_u2f): ../pam-u2f.c:99 (parse_cfg): nouserok=0 debug(pam_u2f): ../pam-u2f.c:100 (parse_cfg): openasuser=1 debug(pam_u2f): ../pam-u2f.c:101 (parse_cfg): alwaysok=0 debug(pam_u2f): ../pam-u2f.c:102 (parse_cfg): authfile=/etc/u2f_keys debug(pam_u2f): ../pam-u2f.c:103 (parse_cfg): origin=(null) debug(pam_u2f): ../pam-u2f.c:104 (parse_cfg): appid=(null) debug(pam_u2f): ../pam-u2f.c:105 (parse_cfg): prompt=(null) debug(pam_u2f): ../pam-u2f.c:146 (pam_sm_authenticate): Origin not specified, using "pam://durruti" debug(pam_u2f): ../pam-u2f.c:156 (pam_sm_authenticate): Appid not specified, using the same value of origin (pam://durruti) debug(pam_u2f): ../pam-u2f.c:165 (pam_sm_authenticate): Maximum devices number not set. Using default (24) debug(pam_u2f): ../pam-u2f.c:183 (pam_sm_authenticate): Requesting authentication for user jkur debug(pam_u2f): ../pam-u2f.c:194 (pam_sm_authenticate): Found user jkur debug(pam_u2f): ../pam-u2f.c:195 (pam_sm_authenticate): Home directory for jkur is /home/jkur debug(pam_u2f): ../pam-u2f.c:235 (pam_sm_authenticate): Using authentication file /etc/u2f_keys debug(pam_u2f): ../pam-u2f.c:245 (pam_sm_authenticate): Switched to uid 1000 debug(pam_u2f): ../util.c:102 (get_devices_from_authfile): Authorization line: jkur:bz1_psgGoVqj7EF6woABHuu4FSQ_oTJz_5zwzE-mIm_KRib_,047d360b8d4c2077430d1c42ff0f39788ec45e805bdc95a8f6b645d781ac00056b19289a9a1519bdbe94de5f7e4a98858811e7e09e34d4c51763287bd9d971134d debug(pam_u2f): ../util.c:107 (get_devices_from_authfile): Matched user: jkur debug(pam_u2f): ../util.c:134 (get_devices_from_authfile): KeyHandle for device number 1: bz1_psgGoVqj7EF6woABHuu4FSQ_oTJz_5zwzE-mIm_KRib_ debug(pam_u2f): ../util.c:153 (get_devices_from_authfile): publicKey for device number 1: 047d360b8d4c2077430d1c42ff0f39788ec45e805bdc95a8f6b645d781ac00056b19289a9a1519bdbe94de5f7e4a98858811e7e09e34d4c51763287bd9d971134d debug(pam_u2f): ../util.c:164 (get_devices_from_authfile): Length of key number 1 is 65 debug(pam_u2f): ../util.c:191 (get_devices_from_authfile): Found 1 device(s) for user jkur debug(pam_u2f): ../pam-u2f.c:256 (pam_sm_authenticate): Switched back to uid 0 USB send: 00ffffffff8600080807060504030201000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 USB write returned 65 now trying with timeout 2 now trying with timeout 4 USB read rc read 64 USB recv: ffffffff8600110807060504030201cafebabe020200000315cea8f3b6d054ce7c6c8da9afb5f9fffb44fc6228a4ecd4dcbacb6d63baba57bc97ec53860e39ae device /dev/hidraw0 discovered as 'U2F Zero' version (Interface, Major, Minor, Build): 2, 2, 0, 0 capFlags: 3 debug(pam_u2f): ../util.c:269 (do_authentication): Device max index is 0 debug(pam_u2f): ../util.c:300 (do_authentication): Attempting authentication with device number 1 debug(pam_u2f): ../util.c:322 (do_authentication): Challenge: { "keyHandle": "bz1_psgGoVqj7EF6woABHuu4FSQ_oTJz_5zwzE-mIm_KRib_", "version": "U2F_V2", "challenge": "XB4nnk8WJwvN6kEmE4bxG_zwHTB0BnPiOa9YkKcL1nA", "appId": "pam:\/\/durruti" } JSON: { "keyHandle": "bz1_psgGoVqj7EF6woABHuu4FSQ_oTJz_5zwzE-mIm_KRib_", "version": "U2F_V2", "challenge": "XB4nnk8WJwvN6kEmE4bxG_zwHTB0BnPiOa9YkKcL1nA", "appId": "pam:\/\/durruti" } JSON challenge URL-B64: XB4nnk8WJwvN6kEmE4bxG_zwHTB0BnPiOa9YkKcL1nA client data: { "challenge": "XB4nnk8WJwvN6kEmE4bxG_zwHTB0BnPiOa9YkKcL1nA", "origin": "pam:\/\/durruti", "typ": "navigator.id.getAssertion" } JSON: { "keyHandle": "bz1_psgGoVqj7EF6woABHuu4FSQ_oTJz_5zwzE-mIm_KRib_", "version": "U2F_V2", "challenge": "XB4nnk8WJwvN6kEmE4bxG_zwHTB0BnPiOa9YkKcL1nA", "appId": "pam:\/\/durruti" } JSON app_id pam://durruti JSON: { "keyHandle": "bz1_psgGoVqj7EF6woABHuu4FSQ_oTJz_5zwzE-mIm_KRib_", "version": "U2F_V2", "challenge": "XB4nnk8WJwvN6kEmE4bxG_zwHTB0BnPiOa9YkKcL1nA", "appId": "pam:\/\/durruti" } JSON keyHandle URL-B64: bz1_psgGoVqj7EF6woABHuu4FSQ_oTJz_5zwzE-mIm_KRib_ USB send: 00cafebabe83006e00020700000065a549964c3b62b878f71cebda3fe1a8a4b50b38645ca277ebb1dbc24f52d67af739e9eb27ecdb0c00b8e469121d93a9d569 USB write returned 65 USB send: 00cafebabe00021d4f2cbc287aea8b36c7eba054246f3d7fa6c806a15aa3ec417ac280011eebb815243fa13273ff9cf0cc4fa6226fca4626ff00000000000000 USB write returned 65 now trying with timeout 2 now trying with timeout 4 now trying with timeout 8 now trying with timeout 16 now trying with timeout 32 now trying with timeout 64 now trying with timeout 128 now trying with timeout 256 now trying with timeout 512 now trying with timeout 1024 USB read rc read 64 USB recv: cafebabe830002698400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 USB data (len 2): 6984 debug(pam_u2f): ../util.c:348 (do_authentication): Device for this keyhandle is not present. USB send: 00cafebabe8100010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 USB write returned 65 now trying with timeout 2 now trying with timeout 4 now trying with timeout 8 now trying with timeout 16 now trying with timeout 32 now trying with timeout 64 now trying with timeout 128 now trying with timeout 256 now trying with timeout 512 now trying with timeout 1024 now trying with timeout 2048 now trying with timeout 4096 ^CUSB read rc read 64 Device /dev/hidraw0 failed ping, dead. USB send: 00ffffffff8600080807060504030201000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ^C^C^C^CUSB write returned -1 debug(pam_u2f): ../util.c:355 (do_authentication): Unable to discover devices debug(pam_u2f): ../pam-u2f.c:293 (pam_sm_authenticate): do_authentication returned -2 debug(pam_u2f): ../pam-u2f.c:312 (pam_sm_authenticate): done. [Fehler bei Authentifizierung] sudo: 1 Fehlversuch bei der Passwort-Eingabe Best regargs, Jörg -- System Information: Debian Release: buster/sid APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'testing'), (500, 'stable'), (150, 'unstable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.14.0-3-amd64 (SMP w/4 CPU cores) Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE=de_DE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages libpam-u2f depends on: ii libc6 2.27-3 ii libpam0g 1.1.8-3.7 ii libu2f-host0 1.1.4-1 ii libu2f-server0 1.1.0-1 Versions of packages libpam-u2f recommends: ii pamu2fcfg 1.0.6-1 libpam-u2f suggests no packages. -- no debconf information -- Jörg ([email protected]) GPG-ID: 0xFAE26711E6EBF94D Fingerprint: 8A79 8BF8 0A04 60EA A004 7E42 FAE2 6711 E6EB F94D
--- End Message ---
--- Begin Message ---Source: pam-u2f Source-Version: 1.0.7-1 We believe that the bug you reported is fixed in the latest version of pam-u2f, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Nicolas Braud-Santoni <[email protected]> (supplier of updated pam-u2f package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Tue, 29 May 2018 14:33:06 +0200 Source: pam-u2f Binary: libpam-u2f pamu2fcfg Architecture: source amd64 Version: 1.0.7-1 Distribution: unstable Urgency: high Maintainer: Debian Authentication Maintainers <[email protected]> Changed-By: Nicolas Braud-Santoni <[email protected]> Description: libpam-u2f - universal 2nd factor (U2F) PAM module pamu2fcfg - universal 2nd factor (U2F) PAM module command-line helper tool Closes: 898519 Changes: pam-u2f (1.0.7-1) unstable; urgency=high . * New upstream version 1.0.7 (2018-05-15) Closes: #898519 * Update & complete debian/copyright * Move the packaging repository to salsa.d.o * Use the tracker.debian.org email address for the maintainers. * Switch to debhelper 11 Checksums-Sha1: a5682765f352a3f827409e766972f7eb1097002c 2371 pam-u2f_1.0.7-1.dsc 5b49857a286b4b0622e10296932b10d8036362cf 378513 pam-u2f_1.0.7.orig.tar.gz f2ecc3ed4f1b2252f4f356c9d4fbebc7937ad200 534 pam-u2f_1.0.7.orig.tar.gz.asc 3e6c861b9835da6f0d4c62422a64775f58a22c87 50324 pam-u2f_1.0.7-1.debian.tar.xz 8852ac9d4f45ad288ff0c825e46334b641a6a802 19780 libpam-u2f-dbgsym_1.0.7-1_amd64.deb b6c7b2d0d562d0600301698227f38f0c37baf52d 26924 libpam-u2f_1.0.7-1_amd64.deb 7bce001eabe9cec91a33d17fa646e9e16caca935 6535 pam-u2f_1.0.7-1_amd64.buildinfo cf304b54cdfa7d45900e766dec1917ca107d570d 15368 pamu2fcfg-dbgsym_1.0.7-1_amd64.deb 0a48aa6a70f95501c7db4d4ceb859259e3e6778e 17068 pamu2fcfg_1.0.7-1_amd64.deb Checksums-Sha256: 13c54274b7b577742b9407dc59b30b29ebb3782e188851be04761d09e9473caa 2371 pam-u2f_1.0.7-1.dsc 034aad8e29b159443dd6c1b7740006addc83d0659304fc4b0b4fb592f768e7cf 378513 pam-u2f_1.0.7.orig.tar.gz 533ab8740815f09cfda3386459a196ddc5facb9edbbeca54f7d1756942d3c542 534 pam-u2f_1.0.7.orig.tar.gz.asc 07def8013606bf2f33dfebdf0eff7f20552da62358a8ff854dde4240d59ad856 50324 pam-u2f_1.0.7-1.debian.tar.xz 96aa87a1691134af17a0a2521093451b6202a8da76b28d176fd265fbc7b3f279 19780 libpam-u2f-dbgsym_1.0.7-1_amd64.deb 82cb4359f75867229ccbe05b43a229a1f1efa74a1f6e35e2c392671906f7a9f2 26924 libpam-u2f_1.0.7-1_amd64.deb e74f449d6d2325d32a99e585ad4da4b87855f53d51d7dec0e4425c105bd7cb31 6535 pam-u2f_1.0.7-1_amd64.buildinfo 8d47ab0455cb01b722111c7ce962a58ec5b433364ffb1a3ac6c2ee3f016f837e 15368 pamu2fcfg-dbgsym_1.0.7-1_amd64.deb 42aba8bb84191ac1ae287e4e066a9f550e5988c96250fcef3ea1d65b3314e069 17068 pamu2fcfg_1.0.7-1_amd64.deb Files: 0d9b8913c91b87ecaa7f4c70976f76d9 2371 admin optional pam-u2f_1.0.7-1.dsc b34e91a03e7e454abd3b5374e76d6221 378513 admin optional pam-u2f_1.0.7.orig.tar.gz 6bee22abab3e59cfe0a73f688d2d9db3 534 admin optional pam-u2f_1.0.7.orig.tar.gz.asc 59eb7464eca356d4451569cbd6088e02 50324 admin optional pam-u2f_1.0.7-1.debian.tar.xz 65c4a21a9210dd9586c243fa003d648c 19780 debug optional libpam-u2f-dbgsym_1.0.7-1_amd64.deb a712a4504d5a74d8c6626bcc3c22443a 26924 admin optional libpam-u2f_1.0.7-1_amd64.deb 503a161edabeec937920c81a77b91065 6535 admin optional pam-u2f_1.0.7-1_amd64.buildinfo f5f57f3d356399160796c579eaea33dc 15368 debug optional pamu2fcfg-dbgsym_1.0.7-1_amd64.deb cd188d8b472f3639d66a829dcd9f5329 17068 admin optional pamu2fcfg_1.0.7-1_amd64.deb -----BEGIN PGP SIGNATURE----- iQJDBAEBCgAtFiEExyA8CpIGcL+U8AuxsB0acqyNyaEFAls1L78PHGpjY0BkZWJp YW4ub3JnAAoJELAdGnKsjcmhIdwQALVEsZrrLPQSBiyGM9u+zwJWTcDbOYfCIrvE S1WgF4nSQJeTBHjMp6fW7CRZ0NN1DjEItwSHaiXGkzdeG+LTJWn1f6q9LAIIETFb 0w83ssCBbNV4erD7MUbrp3Hg8gzxazXsJes/GYnES4KwgjGeUvpjIsMOeKQANIW9 zlNAvKwW/+784Bb5ucMK6ZRWWV3HKSKDVYyYUOOVw6TihWM+xUqv6lMguAGuP1GD cxHoto/WkPpuIzvonkKQIfRcrv71C8jyspxwFd2GqN0c5Q6WCZfUHGLI3xsk8zls O7AM266mcds4XHY0GIBLfIOls4OgCcLd46ya0u58FC4YC5Y/hAj6xQ7HbkrWWA8B yMG1Ttux3f88UJ0+IHjKww1kVkRi9uYbuFJPTUMsuzCXjt/vSKRYIvuekssJtsUw QqrxgOQNMVz5aq7Drveotm8a2thAsv99+BLZ34pgQTLnwddOXuYbezgkoEmYLaqh m0tlOmwrjERaAOZD8SkTK5CIkO5UjTVwyzUW8uoMpoKGoKeE26tKoUVwl2BUcE/f xEVd7YXkQpNo1/0H+Moi7zwOU3rnjxYyZsV0xAVsXunsym8oGuvwlVYRjmOJ7+XY uj9KGvYqi8WhyNCxgtSdQJ53JVcwCIPJVkwQpOKjSz8kvDkQGvkbvV74SL1Wmkp4 1trZyJQ/ =nbzx -----END PGP SIGNATURE-----
--- End Message ---
