Your message dated Mon, 22 Oct 2018 18:03:40 +0200
with message-id <[email protected]>
and subject line Re: Bug#911586: ejabberd: Fail to work with PAM authentication
(wrong euid on epam) with systemd setup
has caused the Debian Bug report #911586,
regarding ejabberd: Fail to work with PAM authentication (wrong euid on epam)
with systemd setup
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
911586: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=911586
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: ejabberd
Version: 16.09-4
Tags: patch
Severity: important
After upgrading the machine to Stretch, ejabberd no longer is able to
authenticate using PAM. The problem is that the
/usr/lib/erlang/p1_pam/bin/epam suid binary is not running as root
despite the suid setup, but as user ejabberd. This make it impossible
for ejabberd to check the password using /etc/shadow. After some
research I tracked this down to the way systemd starts the service, and
was able to get ejabberd to work with PAM again by commenting out the
PrivateDevices line:
--- /tmp/ejabberd.service 2018-10-22 11:15:34.451141940 +0200
+++ /lib/systemd/system/ejabberd.service 2018-10-22 11:12:05.156678797
+0200
@@ -15,7 +15,7 @@
Restart=on-failure
PIDFile=/run/ejabberd/ejabberd.pid
PrivateTmp=true
-PrivateDevices=true
+#PrivateDevices=true
ProtectHome=true
ProtectSystem=full
Please consider changing the default setup for ejabberd in Stretch to
allow it to work with PAM by default.
One of the sources I found during my research was
<URL: https://github.com/processone/ejabberd/pull/1178 >, which mention
this problem. Another is
<URL:
https://groups.google.com/d/msg/linux.debian.bugs.dist/mNjlrUSXvKU/lP4F72UtAgAJ
>.
If you want to test various systemd setup variations, you might find
this oneliner useful:
systemctl daemon-reload; service ejabberd restart; ps -p `pidof epam` -o
user,group,egroup,euser,fgid,fgroup,fuid,fuser,ruser,rgroup,sgroup,suser,supgrp,comm,args
--
Happy hacking
Petter Reinholdtsen
--- End Message ---
--- Begin Message ---
Hi Petter,
thanks for the report, but this has been documented in ejabberd's
README.Debian for quite some time (due to #854178), a quick look into
the docs might have saved you a bit of time ;)
Best wishes,
--
.''`. Philipp Huebner <[email protected]>
: :' : pgp fp: 6719 25C5 B8CD E74A 5225 3DF9 E5CA 8C49 25E4 205F
`. `'`
`-
signature.asc
Description: OpenPGP digital signature
--- End Message ---
