0

I'm using Arch Linux on a single-user workstation with LXDE and lxde-session autologin to the regular user. I then "su" or "sudo" to root privileges, and try to run "useradd."

useradd fails on my system. This system was re-installed from scratch less than a year ago, and has had regular "pacman -Syu" run on it. I don't do much custom system administration; mainly run LXDE and vim/gcc/make as my regular user account. useradd also fails when pacman tries to run it.

I recently ran into a problem where both mariadb and percona-server would fail to start on the system after installation, and tracked it down to the mysql user not being properly created. Trying to run useradd manually, I find that that utility has broken. Googling around, people suggest this might be a problem with /etc/shadow or confg files in /etc/pam.d/, so I looked into that.

The error I get is: useradd: PAM: Authentication service cannot retrieve authentication info

Running strace on useradd, it seems quite capable of opening /etc/shadow and /etc/passwd, and getuid() returns 0 for "root":

open("/etc/pam.d/other", O_RDONLY)      = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=127, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1a7c0eb000
read(3, "#%PAM-1.0\nauth\t\trequired\tpam_uni"..., 4096) = 127
read(3, "", 4096)                       = 0
close(3)                                = 0
munmap(0x7f1a7c0eb000, 4096)            = 0
getuid()                                = 0
getuid()                                = 0
open("/etc/login.defs", O_RDONLY)       = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=5519, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1a7c0eb000
read(3, "#\n# /etc/login.defs - Configurat"..., 4096) = 4096
read(3, "gular users using chfn - use\n# a"..., 4096) = 1423
read(3, "", 4096)                       = 0
close(3)                                = 0
munmap(0x7f1a7c0eb000, 4096)            = 0
open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=610, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1a7c0eb000
read(3, "root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 610
close(3)                                = 0
munmap(0x7f1a7c0eb000, 4096)            = 0
geteuid()                               = 0
open("/etc/shadow", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0600, st_size=413, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f1a7c0eb000
read(3, "root:x::::::\nbin:x:14871::::::\nd"..., 4096) = 413
read(3, "", 4096)                       = 0
close(3)                                = 0
munmap(0x7f1a7c0eb000, 4096)            = 0
write(2, "useradd: PAM: Authentication ser"..., 73useradd: PAM: Authentication service cannot retrieve authentication info
) = 73

The config files look fine:

[root@robot1 jwatte]# cat /etc/pam.d/useradd 
#%PAM-1.0
auth        sufficient  pam_rootok.so
auth        required    pam_unix.so
account     required    pam_unix.so
session     required    pam_unix.so
password    required    pam_permit.so

[root@robot1 jwatte]# cat /etc/pam.d/other 
#%PAM-1.0
auth        required    pam_unix.so
account     required    pam_unix.so
password    required    pam_unix.so
session     required    pam_unix.so
[root@robot1 jwatte]# 

How do I take the next step in resolving and debugging this issue? Is there any debug I can find anywhere about why PAM decides this should fail? Good-old /var/log/auth.log doesn't exist anymore, and journalctl -b is not very helpful:

May 17 09:52:15 robot1 sudo[676]: pam_unix(sudo:session): session opened for user root by jwatte(uid=0)
May 17 09:52:15 robot1 useradd[677]: Authentication service cannot retrieve authentication info
May 17 09:52:15 robot1 useradd[677]: failed adding user 'mysql', data deleted

I still can't get much information out of PAM -- specifically, which module fails, at what step? I've read the code for useradd, and the code for PAM (AAAUUGH! THE GOGGLES! THEY DO NOTHING!) I ended up adding pam_warn.so to "others" and "useradd" for the "account" action, and I got one (1) more line into the journalctl:

May 17 11:04:54 robot1 useradd[29944]: pam_warn(useradd:account): function=[pam_sm_acct_mgmt] service=[useradd] terminal=[<unknown>] user=[root] ruser=[<unknown>] rhost=[<unknown>]

Does it matter that terminal, ruser, and rhost are unknown? How would I found out?

migrated from serverfault.com May 19 '14 at 14:20

This question came from our site for system and network administrators.

2

Look at the first line in /etc/shadow: it seems that one field is missing

0

The unknown ruser and rhost are expected, since you are not remote. The unknown terminal might be surprising but is probably not the source of your trouble.

Most PAM modules take a debug parameter that might give you more information. E.g.,

auth        required    pam_unix.so debug

Do you have something like LDAP configured for accounts, such as in /etc/nsswitch.conf? The "cannot retrieve authentication info" reminds of the sort of errors I have seen trying to add local users on a system with LDAP accounts.

Does Arch Linux have anything like SELinux or other advanced security layer?

  • Thanks for the answer -- I'll try adding the "debug" part and see if it helps any. No, I'm not trying to LDAP or anything else advanced -- this is very much a dedicated single user device that doesn't need security. – Jon Watte May 19 '14 at 16:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.