[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#798301: Doesn't support 'sufficient' pam entries (like libpam-fprintd's) anymore



Control: tag -1 + moreinfo

¡Hola Didier!

El 2015-09-07 a las 22:25 +0200, Didier 'OdyX' Raboud escribió:
With libpam-fprintd installed and configured, aka the following pam configuration:

$ grep -v '^#' /etc/pam.d/common-auth auth [success=2 default=ignore] pam_fprintd.so max_tries=1 timeout=10 # debug auth [success=1 default=ignore] pam_unix.so nullok_secure try_first_pass auth requisite pam_deny.so auth required pam_permit.so auth optional pam_cap.so

sddm doesn't launch the session anymore: the fingerprint reading works, but then sddm is hung, without a possibility to open another session, or do anything besides either restarting sddm (through tty1), or rebooting.

It used to work, both in kdm, and earlier in stretch's lifecycle.

How can I debug to see what broke?

I don't have the corresponding hardware so I can't really test this. My wild guess is that one of the modules listed in the pam file (most probably gnome-keyring or kwallet) is trying to read (the supposedly already loaded) password, and fail.

As such I would suggest to progressively disable the modules in /etc/pam.d/sddm, checking the output of the change in /var/log/auth.log, and provide the results of this debugging process.

Happy hacking,
--
"Whenever possible, steal code." -- Tom Duff
Saludos /\/\ /\ >< `/

Attachment: signature.asc
Description: PGP signature


Reply to: