GNU bug report logs - #63198
cups-service-type uses PAM-enabled 'cups' by default which prevents authentication

Previous Next

Full log

View this message in rfc822 format

From: help-debbugs <at> gnu.org (GNU bug Tracking System)
To: Maxim Cournoyer <maxim.cournoyer <at> gmail.com>
Cc: tracker <at> debbugs.gnu.org
Subject: bug#63198: closed (cups-service-type uses PAM-enabled 'cups' by
 default which prevents authentication)
Date: Wed, 03 May 2023 12:47:02 +0000

[Message part 1 (text/plain, inline)]

Your message dated Wed, 03 May 2023 08:46:14 -0400
with message-id <87o7n1zip5.fsf <at> gmail.com>
and subject line Re: bug#63198: cups-service-type uses PAM-enabled 'cups' by default which prevents authentication
has caused the debbugs.gnu.org bug report #63198,
regarding cups-service-type uses PAM-enabled 'cups' by default which prevents authentication
to be marked as done.

(If you believe you have received this mail in error, please contact
help-debbugs <at> gnu.org.)


-- 
63198: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=63198
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems

[Message part 2 (message/rfc822, inline)]

From: Maxim Cournoyer <maxim.cournoyer <at> gmail.com>
To: bug-guix <bug-guix <at> gnu.org>
Subject: cups-service-type uses PAM-enabled 'cups' by default which prevents
 authentication
Date: Sun, 30 Apr 2023 23:08:13 -0400

Hi,

Today I encountered an issue where after re-installing a Guix System, I
couldn't add a new printer anymore.  Any CUPS client (including the
trusty localhost:631 HTTP page) would loop on authenticating my user.

After consulting the logs and finding this kind of line:

--8<---------------cut here---------------start------------->8---
pam_authenticate() returned 7 (Authentication failure)
--8<---------------cut here---------------end--------------->8---

I started looking at our PAM configuration for CUPS, but we currently
have none, which is probably the issue.  Using 'cups-minimal' instead of
cups (which is built with linux-pam) solves the issue, as the 'cups'
value provided to the <cups-configuration> record.

We should probably make cups-minimal the default, or extend our
pam-service-type with the relevant PAM entries.

Thoughts/takers?

-- 
Thanks,
Maxim

[Message part 3 (message/rfc822, inline)]

From: Maxim Cournoyer <maxim.cournoyer <at> gmail.com>
To: 63198-done <at> debbugs.gnu.org
Subject: Re: bug#63198: cups-service-type uses PAM-enabled 'cups' by default
 which prevents authentication
Date: Wed, 03 May 2023 08:46:14 -0400

Hi,

Maxim Cournoyer <maxim.cournoyer <at> gmail.com> writes:

> Hi,
>
> Today I encountered an issue where after re-installing a Guix System, I
> couldn't add a new printer anymore.  Any CUPS client (including the
> trusty localhost:631 HTTP page) would loop on authenticating my user.
>
> After consulting the logs and finding this kind of line:
>
> pam_authenticate() returned 7 (Authentication failure)
>
> I started looking at our PAM configuration for CUPS, but we currently
> have none, which is probably the issue.  Using 'cups-minimal' instead of
> cups (which is built with linux-pam) solves the issue, as the 'cups'
> value provided to the <cups-configuration> record.

Fixed using the above strategy in 6bc3e3f ("services: cups: Use
cups-minimal to avoid PAM authentication.")

-- 
Thanks,
Maxim

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.