Bug 16668 - Password editing function broken and expired users with userdrake ('Invalid contents of lock `/etc/shadow.lock'')
Summary: Password editing function broken and expired users with userdrake ('Invalid c...
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: Cauldron
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: Thierry Vignaud
QA Contact:
URL:
Whiteboard:
Keywords: 6dev1
Depends on:
Blocks:
 
Reported: 2015-08-29 07:33 CEST by Jin-tong Hu
Modified: 2016-07-06 17:12 CEST (History)
11 users (show)

See Also:
Source RPM: libuser
CVE:
Status comment:


Attachments

Description Jin-tong Hu 2015-08-29 07:33:17 CEST
Description of problem:
In Konsole, start drakconf as root. Then go to System -> Manage users on system, and select one user then edit his password. Restart the system, and type the new password when the login screen appears. The result is "login failed," and no matter what password I enter, I can no longer login to my system.

Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1.
2.
3.


Reproducible: 

Steps to Reproduce:
Javier GG 2015-08-29 20:32:21 CEST

CC: (none) => jgomezgil
Hardware: i586 => All

Thierry Vignaud 2015-09-01 14:26:40 CEST

Source RPM: (none) => userdrake, libuser
CC: (none) => thierry.vignaud

Comment 1 Thierry Vignaud 2015-09-03 14:13:36 CEST
Are you sure you're not suffering from bug #16467 ?
What does report the following command?
rpm -qa 'lib*user*' userdrake

Keywords: (none) => NEEDINFO

Comment 2 Thierry Vignaud 2015-09-03 14:15:19 CEST
It can also be bug #12203
Comment 3 Javier GG 2015-09-03 21:29:15 CEST
(In reply to Thierry Vignaud from comment #1)
> Are you sure you're not suffering from bug #16467 ?
> What does report the following command?
> rpm -qa 'lib*user*' userdrake

rpm -qa 'lib*user*' userdrake
libuser-0.60-8.mga6
lib64pam_userpass1-1.0.2-11.mga6
userdrake-2.10-3.mga6
lib64user1-0.60-8.mga6
Comment 4 Javier GG 2015-09-03 21:44:12 CEST
The same problem appears with a new user created with userdrake.  But if you change the password with passwd and restart the system, then you can login again.

Userdrake encrypts the password with SHA512 and passwd with blowfish.
Comment 5 Jin-tong Hu 2015-09-04 01:08:40 CEST
(In reply to Thierry Vignaud from comment #1)
> Are you sure you're not suffering from bug #16467 ?
> What does report the following command?
> rpm -qa 'lib*user*' userdrake

My i586 system:

libuser1-0.60-8.mga6
libpam_userpass1-1.0.2-11.mga6
libuser-0.60-8.mga6
userdrake-2.10-3.mga6
Comment 6 Jin-tong Hu 2015-09-04 01:31:11 CEST
(In reply to Javier Gómez from comment #4)
> The same problem appears with a new user created with userdrake.  But if you
> change the password with passwd and restart the system, then you can login
> again.
> 
> Userdrake encrypts the password with SHA512 and passwd with blowfish.

The same here.

In fact, I changed my password and root password with password editing function in drakconf, and then restarted my system, only to find I could no longer login to my system. I almost couldn't find a way to login to reset or modify my password and root password. Finally I entered the safe (recovery?) mode and found in this mode I could login with the new root password, so I changed my password and root password with passwd command, and then I restarted my system and login my system successfully.
Comment 7 Jin-tong Hu 2015-09-05 06:36:23 CEST
(In reply to Thierry Vignaud from comment #2)
> It can also be bug #12203

Not this bug 'cause I enter my new password entirely instead of appending some additional characters to the original password.
Comment 8 Jin-tong Hu 2015-09-05 09:12:39 CEST
(In reply to Thierry Vignaud from comment #1)
> Are you sure you're not suffering from bug #16467 ?
> What does report the following command?
> rpm -qa 'lib*user*' userdrake

I've read the entire thread in bug #16467 . It seems I'm suffering from something similar to part of that bug. To be precise, I don't suffering from the "/etc/shadow.lock" error message and the expiration problem. However, I'm indeed suffering from the exact same issues in comments https://bugs.mageia.org/show_bug.cgi?id=16467#c14 :

"Changing the password of an existing user results in a login failure for that user, with a similar odd looking entry in /etc/shadow."

& https://bugs.mageia.org/show_bug.cgi?id=16467#c17 :

"Using passwd to change the password, creates a normal looking entry in /etc/shadow and makes it possible to login. Using lpasswd to again change the password results again in an abnormal /etc/shadow entry and makes it impossible to login."


And I've done an experiment:

1. Using userdrake to change my password to a new one, eg., qmxdqm5566, and the password (i.e., 2nd) field of my account entry in /etc/shadow was 106 characters long.

2. Using passwd to change my password to the same one (i.e., qmxdqm5566), and the password (2nd) field of my account entry in /etc/shadow was only 60 characters long.

3. Using lpasswd to change my password to the same one (qmxdqm5566), and the password (2nd) field of my account entry in /etc/shadow was again 106 characters long.


Finally, the problem here only occurs on my Cauldron, but not on my Mageia 5 system.
Comment 9 Maurice Batey 2015-10-21 16:46:01 CEST
I have a similar problem, with Cauldron update of 64-bit Mageia-5 on real h/w.

Within a Plasma login, if I use MCC/System/Manage Users to set up other users, their entry in that table shows (under 'Status') "Expired", and any attempt to log one in fails.

If I delete those users and re-specify them, the same thing happens.
  (The 'Expiry' option is disabled; also tried enabling it and setting 2016 as expiry year).)

Discovered this when trying to check out the kwrite problem:

       https://bugs.mageia.org/show_bug.cgi?id=16727

and needing a 'junk' user.

CC: (none) => maurice

Comment 10 Maurice Batey 2015-10-21 19:19:37 CEST
> Within a Plasma login, if I use MCC/System/Manage Users to set up other users, > their entry in that table shows (under 'Status') "Expired", and any attempt to > log one in fails.

  Have now used 'chage' to remove the 'expired status' from the 2nd user, but even after reboot I still cannot log into that user.

   (Also tried disabling the 'Password Expiration' option and rebooted, but still cannot do that login.)

  Never problem with 1st user...
Comment 11 Maurice Batey 2015-10-21 20:39:19 CEST
P.S. Got exactly same problem with 2nd user on Cauldron Plasma on netbook.
Comment 12 Rubén Fernández 2015-10-24 09:43:56 CEST
I've had the same problem with Mageia 5 on my own machine when changing a user's password: constant login errors. passwd has worked though.
I imagine what would happen if I changed my root or main user password through userdrake and gives me the shivers. This issue is critical, fix it before hundreds of users get locked out of their computers!

CC: (none) => ruben33en-mandriva

Comment 13 Maurice Batey 2015-10-25 14:19:34 CET
> ...used 'chage' to remove the 'expired status' from the 2nd user, but even 
> after reboot I still cannot log into that user.

Can now consistently boot into 2nd user, by using 'passwd' to change password.
N.B. 'passwd' would not permit an 'inadequate' password; the one a satisfied it with also permits login...

What seems to have happened is that MCC/System/Manage Users allowed the entry of an inadequate password, which the system was later not accepting for login.
Comment 14 Marja Van Waes 2016-01-16 10:27:08 CET
removing NEEDINFO bacause afaics the requested information was given

assigning to Thierry because he already took an interest in this report (not sure the bug is in our tools, though)

Keywords: NEEDINFO => (none)
CC: (none) => marja11
Assignee: bugsquad => thierry.vignaud

Comment 15 Atilla ÖNTAŞ 2016-02-06 19:10:47 CET
Today i' ve bitten by this bug (and exact symptoms of bug #16467) on my Cauldron machine. Neither guest account nor newly created user can login. Guest and new user are in "Expired" status and i get same error message on terminal with userdrake:

> [atilla@tarakbumba ~]$ userdrake
> Ignore the following Glib::Object::Introspection & Gtk3 warnings
> Subroutine Gtk3::main redefined at /usr/lib/perl5/vendor_perl/5.22.0/Gtk3.pm line 525.
> Hesap oluÅturma iÅlemi baÅarısız oldu: 'Invalid contents of lock `/etc/shadow.lock''.

Installed rpms related this issue:

userdrake-2.10-5.mga6
lib64user1-0.62-2.mga6
lib64pam_userpass1-1.0.2-12.mga6

CC: (none) => tarakbumba

Comment 16 Marja Van Waes 2016-02-06 21:02:04 CET
@ philippem

In bug 16467 I read that you were concerned that this bug hadn't gotten fixed in cauldron.

You were right, it does indeed still exist.

Would you have time to help fix it in cauldron, too?

Summary: Password editing function broken in drakconf => Password editing function broken and expired users with userdrake ('Invalid contents of lock `/etc/shadow.lock'')
CC: (none) => makowski.mageia

Comment 17 Philippe Makowski 2016-04-07 09:42:23 CEST
(In reply to Marja van Waes from comment #16)
> @ philippem
> 
> In bug 16467 I read that you were concerned that this bug hadn't gotten
> fixed in cauldron.
> 
> You were right, it does indeed still exist.
> 
> Would you have time to help fix it in cauldron, too?

I will try, seems that https://bugs.mageia.org/show_bug.cgi?id=17095 is a duplicate of this one.
Comment 18 Philippe Makowski 2016-04-07 11:53:31 CEST
Please try with libuser-0.62-3.mga6
https://bugs.mageia.org/show_bug.cgi?id=17095#c7
Comment 19 Marja Van Waes 2016-04-07 14:22:25 CEST
(In reply to Philippe Makowski from comment #17)
> (In reply to Marja van Waes from comment #16)
> > @ philippem
> > 
> > In bug 16467 I read that you were concerned that this bug hadn't gotten
> > fixed in cauldron.
> > 
> > You were right, it does indeed still exist.
> > 
> > Would you have time to help fix it in cauldron, too?
> 
> I will try, seems that https://bugs.mageia.org/show_bug.cgi?id=17095 is a
> duplicate of this one.

Yeah, it is, thx. I'll close it as dup to get all comments on libuser-0.62-3.mga6 in one place
Comment 20 Marja Van Waes 2016-04-07 14:23:34 CEST
*** Bug 17095 has been marked as a duplicate of this bug. ***

CC: (none) => westel

Comment 21 Marja Van Waes 2016-04-07 14:24:56 CEST
(In reply to Philippe Makowski from comment #18)
> Please try with libuser-0.62-3.mga6
> https://bugs.mageia.org/show_bug.cgi?id=17095#c7

Thanks, Philippe, that package fixes it for me.

Awaiting some more feedback before closing this bug, though

Keywords: (none) => 6dev1

Comment 22 Maurice Batey 2016-04-07 17:48:42 CEST
(In reply to Philippe Makowski from comment #18)
> Please try with libuser-0.62-3.mga6
> https://bugs.mageia.org/show_bug.cgi?id=17095#c7

Could you remind me how to get that version installed on 64-bit Mageia-6-dev1, please?
Comment 23 Rémi Verschelde 2016-04-07 18:22:08 CEST
(In reply to Maurice Batey from comment #22)
> (In reply to Philippe Makowski from comment #18)
> > Please try with libuser-0.62-3.mga6
> > https://bugs.mageia.org/show_bug.cgi?id=17095#c7
> 
> Could you remind me how to get that version installed on 64-bit
> Mageia-6-dev1, please?

Just do the normal updates with MageiaUpdate or "urpmi --auto-update" once the package has landed on your mirror.
Comment 24 Maurice Batey 2016-04-07 19:07:08 CEST
I had been doing updates, but just now that package was finally offered.

After deleting the 1st attempt to add a 2nd user and adding a new on, I can confirm that the 2nd user entry in MCC/System/Users no longer has Status = Expired.

However, even after a reboot, the system still only presents the 1st user in the Plasma Login greeter, and I cannot 'switch to another user'.
Comment 25 Philippe Makowski 2016-04-07 19:12:01 CEST
(In reply to Maurice Batey from comment #24)
> However, even after a reboot, the system still only presents the 1st user in
> the Plasma Login greeter, and I cannot 'switch to another user'.

seems that it is another bug, not the same. Certainly it should be reported in a new bug report.

may be it's just a problem with user id ?
can you post here the line with your new user in /etc/passwd ?
Comment 26 Maurice Batey 2016-04-07 20:08:16 CEST
cat /etc/passwd | grep 150
mab:x:1500:1500:Maurice:/home/mab:/bin/bash
lin:x:1501:1501:Linnea:/home/lin:/bin/bash


The 'missing user' problem was handled in another bug report.
 Will dig around for it.
Comment 27 Maurice Batey 2016-04-07 20:24:52 CEST
> Certainly it should be reported in a new bug report.

  See https://bugs.mageia.org/show_bug.cgi?id=18157
Comment 28 Marja Van Waes 2016-04-07 22:39:50 CEST
Just for the record, sddm does, since bug 16493 got fixed, no longer provide a list of users + their "faces". It only shows the user name of the last user that logged out. It is considered insecure to show all users.

However, you should be able to wipe that name and type another user name. That works fine here with the user that I created after new libuser-0.62-3.mga6 was installed, so logging into his own Plasma5 session went well.
Angelo Naselli 2016-05-05 14:52:52 CEST

CC: (none) => anaselli

Comment 29 Doug Laidlaw 2016-05-15 08:34:48 CEST
I am not sure if I need to report a separate bug.  I currently have libuser-0.62-4.mga6 in a 64-bit cauldron system.  I tried to add myself to the "Wheel" group with MCC.

My last step was to put back my user password, which had been replaced by 4 dots.
The screen was updated, but on clicking OK, I got the "/etc/shadow/lock" error discussed in an earlier bug, and mentioned in the title of this bug.  Rebooting was no help.

The existing user password was unchanged, so I can still log in as before. I still need to be root to start MCC.

I haven't specifically tested Mga5, but I haven't noticed any problem.

CC: (none) => laidlaws

Comment 30 Marja Van Waes 2016-06-06 17:36:10 CEST
(In reply to Doug Laidlaw from comment #29)

> The screen was updated, but on clicking OK, I got the "/etc/shadow/lock"
> error discussed in an earlier bug, and mentioned in the title of this bug. 

I see it again, too. Someone should have tested right after you reported it :-/

Just tried to add a new user in MCC, and it fails with the same error. The user does get listed, but with expired account, like before :-(

I had libuser-0.62-4.mga6 installed, which got pushed on the 4th of May, 11 days before you added your comment.

It is beyond my understanding how in the world 

    Requires:       coreutils
    Requires(pre):  coreutils

could cause this :-(

However, locally building the previous version, and downgrading to libuser-0.62-3.mga6 & lib64user1-0.62-3.mga6, fixes it: adding a user with userdrake works fine again.

@ Philippem

I haven't tried locally building libuser-0.62-4, because I assume the BS doesn't build something else than you tells it to.

Source RPM: userdrake, libuser => libuser-0.62-4.mga6

Comment 31 Doug Laidlaw 2016-06-06 17:51:41 CEST
>> The screen was updated, but on clicking OK, I got the "/etc/shadow/lock"
>> error discussed in an earlier bug, and mentioned in the title of this bug. 

> I see it again, too. Someone should have tested right after you reported it :-/

That was my fault, posting to a bug that looked finalized.
Comment 32 Philippe Makowski 2016-06-06 19:06:20 CEST
(In reply to Marja van Waes from comment #30)
> However, locally building the previous version, and downgrading to
> libuser-0.62-3.mga6 & lib64user1-0.62-3.mga6, fixes it: adding a user with
> userdrake works fine again.
> 
> @ Philippem
> 
> I haven't tried locally building libuser-0.62-4, because I assume the BS
> doesn't build something else than you tells it to.

Sorry I can't do anything about that, I don't understand, please Thierry or Pascal or someone else take care of this.
Marja Van Waes 2016-06-06 21:36:08 CEST

Blocks: (none) => 18641

Comment 33 Marja Van Waes 2016-06-06 21:39:13 CEST
(In reply to Doug Laidlaw from comment #31)
> >> The screen was updated, but on clicking OK, I got the "/etc/shadow/lock"
> >> error discussed in an earlier bug, and mentioned in the title of this bug. 
> 
> > I see it again, too. Someone should have tested right after you reported it :-/
> 
> That was my fault, posting to a bug that looked finalized.

(In reply to Philippe Makowski from comment #32)
> (In reply to Marja van Waes from comment #30)
> > However, locally building the previous version, and downgrading to
> > libuser-0.62-3.mga6 & lib64user1-0.62-3.mga6, fixes it: adding a user with
> > userdrake works fine again.
> > 
> > @ Philippem
> > 
> > I haven't tried locally building libuser-0.62-4, because I assume the BS
> > doesn't build something else than you tells it to.
> 
> Sorry I can't do anything about that, I don't understand, please Thierry or
> Pascal or someone else take care of this.

Opened bug 18641 for this problem, and closing this one as fixed again, because it had been fixed.

Status: NEW => RESOLVED
Blocks: 18641 => (none)
Resolution: (none) => FIXED
Source RPM: libuser-0.62-4.mga6 => libuser

Comment 34 Morgan Leijström 2016-07-06 16:37:23 CEST
Sure this is solved?

I now installed the official sta1:

The user created during install works.

- and at this time i did an full system update -

But users created in userdrake could not log in.

back in userdrake i see user is disabled and when i try edit the user i get that "Invalid contents of lock `/etc/shadow.lock'"

Deleted that file and i could edit user and now he can log in.

CC: (none) => fri

Comment 35 Morgan Leijström 2016-07-06 17:12:12 CEST
Ah, sorry for the noise -> the active bug for this is Bug 17504

Note You need to log in before you can comment on or make changes to this bug.