rpms/systemd
7
0
Fork 0
Code Issues Pull Requests Releases Activity

pam: do not require a non-expired password for user@.service

Browse Source 
Without this parameter, we would allow user@ to start if the user
has no password (i.e. the password is "locked"). But when the user does have a password,
and it is marked as expired, we would refuse to start the service.
There are other authentication mechanisms and we should not tie this service to
the password state.

The documented way to disable an *account* is to call 'chage -E0'. With a disabled
account, user@.service will still refuse to start:

systemd[16598]: PAM failed: User account has expired
systemd[16598]: PAM failed: User account has expired
systemd[16598]: user@1005.service: Failed to set up PAM session: Operation not permitted
systemd[16598]: user@1005.service: Failed at step PAM spawning /usr/lib/systemd/systemd: Operation n  ot permitted
systemd[1]: user@1005.service: Main process exited, code=exited, status=224/PAM
systemd[1]: user@1005.service: Failed with result 'exit-code'.
systemd[1]: Failed to start user@1005.service.
systemd[1]: Stopping user-runtime-dir@1005.service...

RHEL-only

Resolves: #2059553
This commit is contained in:
David Tardon 2022-03-01 10:59:45 +01:00
parent a7a177e071
commit 4ab2887d57
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
systemd-user
View File

@ -2,6 +2,7 @@
# #
# Used by systemd --user instances. # Used by systemd --user instances.
account sufficient pam_unix.so no_pass_expiry
account include system-auth account include system-auth
session required pam_selinux.so close session required pam_selinux.so close