Bug 31653

Summary: Mageia Control Center user password request correct?
Product: Mageia Reporter: Ezequiel Partida <ezequiel_partida>
Component: RPM PackagesAssignee: Mageia Bug Squad <bugsquad>
Status: RESOLVED INVALID QA Contact:
Severity: major    
Priority: Normal CC: davidwhodgins, lewyssmith
Version: Cauldron   
Target Milestone: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Source RPM: CVE:
Status comment:

Description Ezequiel Partida 2023-03-09 20:17:43 CET
Description of problem:

Yesterday I created 2 users for testing since I´be reported another bug that was solved.

My original user is ezequiel, this was created when I did the fresh install.

I created 2 other users, test1 and test2.

Today I login as ezequiel, clicked on the MCC icon on the lower plasma 5 panel and I got a window asking for password for test2.

It tried with my ezequiel password and it did not work, but it did with test2


On user settings it appears

User Name User ID Primary Group  Full Name   Login Shell  Home Directory
ezequiel   1000    ezequiel   Ezequiel    /bin/bash     /home/ezequiel
test1      1001    test1      test1       /bin/bash     /home/test1
test2      1001    test2      test2       /bin/bash     /home/test2

Now, one detail here.. 

test1 was created with MMC User tool
test2 was created with plasma 5 system settings user tool

So I created user test3 with mcc user tool, to see if mcc was getting confused with last user created

I log in with test3 to create the profile, log off and then login as ezequiel

Still get the prompt for test2

I created user test4 (Standard type) with systemsettings, loging as test4... ran mcc and got prompt for test2.

I created one last user test5 but this time as administrator, now it asks me to authenticate with eigher test2 or test5.

Is this normal?

Is asking me to authenticate with test2 and test 5 and it never asked me to authenticate as ezequiel.

regards
Comment 1 Lewis Smith 2023-03-09 21:01:50 CET
Thank you for the report. To summarise the original problem:

"My original user is ezequiel, this was created when I did the fresh install.
I created 2 other users:
- test1 [via MCC]
- test2 [via plasma 5 system settings user tool].
Today I login as ezequiel, clicked on the MCC icon on the lower plasma 5 panel and I got a window asking for password for test2."

This is clearly wrong. New users should end up equal however they are created. 
The user settings list has a faulty UID for test2, the same as test1. Makes the Plasma tool suspect.

Can you post the output of:
 $ grep ezequiel /etc/passwd
and
 $ grep '^test' /etc/passwd

CC: (none) => lewyssmith

Comment 2 Ezequiel Partida 2023-03-09 23:23:31 CET
Hello Lewis


 $ grep ezequiel /etc/passwd
ezequiel:x:1000:1000:Ezequiel:/home/ezequiel:/bin/bash

 $ grep test1 /etc/passwd
test1:x:1001:1001:test1:/home/test1:/bin/bash
 $ grep test2 /etc/passwd
test2:x:1002:1002:test2:/home/test2:/bin/bash


I did test on another fresh install

I open System Settings / personalization / Users

+ Add new user

Name: testone
Username: testone
Account type:  Administrator
password: 12345
confirm password: 12345


If account type is Standard this won´t happen, only Administrator

I now open MCC and it is asking for testone password and not root or ezequiel.

Regards
Comment 3 Lewis Smith 2023-03-10 21:34:10 CET
Thank you for the /etc/passwd lines. In fact they show that the UID for 'test2' was correct, unique, not as shown in comment 0.

I am afraid your last note above is quite unclear:
> open MCC and it is asking for testone password and not root or ezequiel
You do not say what user you are logging in as. Is what you say correct behaviour, or testone password being asked for when logged into a different user?
Your original post indicates that after you created new users, whatever you then logged in as you always got asked for test2 password - except also test5 (administrator) password *as well* if logged in as that.

> If account type is Standard this won´t happen, only Administrator
As far as I can see, only Plasma System Settings, not MCC, offers the choice of 'standard' or 'administrator' for a new user. This difference is obscure (see useradd man page -r option).
That apart, I do not see what you are saying here. Are you talking about the user logged in getting asked for the wrong MCC password?

I will try and re-create this tomorrow.
Comment 4 Lewis Smith 2023-03-11 20:55:03 CET
Did not take long!
Under Plasma, using its System Setting-User-Create new user dialogue, I created a new 'standard' user "test1P", same name, user and password.
All sorts of things went wrong. In /etc/passwd, the username was just 'test1'; but its group was shown 'test1P'. The home directory was named also just 'test1'. I certainly got a wrong password prompt from MCC, but cannot remember whether logged in as the permanent or new user. I need to re-do this with more careful notes, but it was a shambles. I suspect Plasma.
Comment 5 Lewis Smith 2023-03-11 21:48:53 CET
Best to *ignore* the previous comment. All its confusion was because Unix usernames do not have uppercase letters, so 'test1P' got quietly clipped by the new user dialogue to just 'test1'; I did not notice, but it explains most of the anomolies.
Start again...

* As normal user, create a new one "test1p" via System Settings. The result was all correct (/etc/passwd & /home/). I noticed that the UID was 1 more than that of the normal user, where there was an empty value below it. Unimportant.
- Logged out/in again as normal user. The user list was correct. MCC asks for the correct password.
- Logged out, back in as the new user "test1p". 'id' shows all correct details. But *MCC ASKS FOR THE WRONG PASSWORD*, that of the normal user; the basis of this bug.

* Deleted that new user.

* As normal user, create a new one "test1m" via MCC. The result was all correct (/etc/passwd & /home/). The UID used was the available free one less than the normal user.
- Logged out, login shows also new user, logged in as that "test1m". 'id' shows correct details. But again, *MCC ASKS FOR THE WRONG PASSWORD*, that of the normal user.
This shows that the problem has nothing to do with whether the new user is created via Plasma or MCC.
I repeated the logout/in as new user with re-start of X between, in case that was relevant. It changed nothing.

So MCC authentification is funny.

CC: lewyssmith => (none)
Summary: Mageia Control Center confusing login users. Or is it normal? => Mageia Control Center can ask for the WRONG user password.
Severity: normal => major
Assignee: bugsquad => mageiatools

Comment 6 Dave Hodgins 2023-03-11 23:03:26 CET
My understanding is that which password is asked for depends on which groups
the user is a member of, the security level chosen in /etc/sysconfig/system,
and the settings chosen in draksec.

CC: (none) => davidwhodgins

Lewis Smith 2023-03-12 09:09:22 CET

Assignee: mageiatools => bugsquad
CC: (none) => lewyssmith

Lewis Smith 2023-03-12 09:12:25 CET

Summary: Mageia Control Center can ask for the WRONG user password. => Mageia Control Center user password request correct?

Comment 7 Lewis Smith 2023-03-12 09:32:48 CET
(In reply to Dave Hodgins from comment #6)
> My understanding is that which password is asked for depends on which groups
> the user is a member of, the security level chosen in /etc/sysconfig/system,
> and the settings chosen in draksec.
Of course. This has just dawned on me, after a lot of pointless experimenting. Everything I have written in this bug is useless hot air.

Obviously you cannot have any user manipulating MCC or doing other privilaged operations! I just experimented creating via Plasma System Settings an 'admin' user, whose correct own username was asked for when logged in as it. For fiddling with the system, a privilaged password is obviously necessary.
The original defined user is automatically privilaged, so it is his password (or that of another privilaged user) that is required for lesser users. All this is  common sense.

@Ezequiel
So the answer to your original question "Is this right?" was "Yes". Any 'normal' user has to give a privilaged user password for MCC and similar things. If, as you did (but I did not understand your explanation) you create an 'admin' user, that user gets asked for its own password. So the behaviour noted in the bug is correct.

Resolution: (none) => INVALID
Status: NEW => RESOLVED