2

I have debootstraped version of wheezy on my Archlinux machine and would like to change it's root password:

echo "root:toor" | chpasswd --root /home/containers/wheezy/

However I get an error:

chpasswd: PAM: Permission denied

Works fine on my local root user (without --root option).

The man page clearly states the following:

-R, --root CHROOT_DIR
Apply changes in the CHROOT_DIR directory and use the configuration files from the CHROOT_DIR directory.

So what am I doing wrong? And how does PAM get involved anyway? Other methods to do this?

EDIT

# echo "root:toor" | sudo strace -f -efile,execve chpasswd --root /home/containers/wheezy/

Below is the output where chpasswd starts complaining.

open("/usr/share/locale/locale.alias", O_RDONLY|O_CLOEXEC) = 3
open("/usr/share/locale/en_GB.UTF-8/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_GB.utf8/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_GB/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.UTF-8/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.utf8/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_GB.UTF-8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_GB.utf8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en_GB/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.UTF-8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en.utf8/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
open("/usr/share/locale/en/LC_MESSAGES/shadow.mo", O_RDONLY) = -1 ENOENT (No such file or directory)
chpasswd: PAM: Permission denied
+++ exited with 1 +++

EDIT2

I have found that the files chpasswd is expecting on the target container can be found for many other languages except English:

# find /usr/share/locale/ -iname '*Linux-PAM.mo*'
/usr/share/locale/hu/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/zh_CN/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/it/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/zu/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/ko/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/or/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/nl/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/sk/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/ja/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/da/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/uk/LC_MESSAGES/Linux-PAM.mo
...
/usr/share/locale/pt_BR/LC_MESSAGES/Linux-PAM.mo
/usr/share/locale/ta/LC_MESSAGES/Linux-PAM.mo

Note: en_GB which chpasswd is expecting might be equal to uk on the target container?..

I've tried to reinstall packages which seem to have required files:

apt-get install --reinstall libpam-runtime login locales locales-all

But that didn't help at all.

EDIT3

When I run strace on the target container it is not looking for these files:

# echo "root:toor2" | strace -f -e open chpasswd --root /
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib/x86_64-linux-gnu/libpam.so.0", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libpam_misc.so.0", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libselinux.so.1", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libcrypt.so.1", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libdl.so.2", O_RDONLY) = 3
open("/proc/filesystems", O_RDONLY)     = 3
open("/etc/pam.d/chpasswd", O_RDONLY)   = 3
open("/etc/pam.d/common-password", O_RDONLY) = 4
open("/lib/x86_64-linux-gnu/security/pam_unix.so", O_RDONLY) = 5
open("/etc/ld.so.cache", O_RDONLY)      = 5
open("/lib/x86_64-linux-gnu/libnsl.so.1", O_RDONLY) = 5
open("/lib/x86_64-linux-gnu/security/pam_deny.so", O_RDONLY) = 5
open("/lib/x86_64-linux-gnu/security/pam_permit.so", O_RDONLY) = 5
open("/etc/pam.d/other", O_RDONLY)      = 3
open("/etc/pam.d/common-auth", O_RDONLY) = 4
open("/etc/pam.d/common-account", O_RDONLY) = 4
open("/etc/pam.d/common-password", O_RDONLY) = 4
open("/etc/pam.d/common-session", O_RDONLY) = 4
open("/etc/passwd", O_RDONLY)           = 3
open("/etc/passwd", O_RDONLY)           = 3
open("/etc/nsswitch.conf", O_RDONLY)    = 3
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib/x86_64-linux-gnu/libnss_compat.so.2", O_RDONLY) = 3
open("/etc/ld.so.cache", O_RDONLY)      = 3
open("/lib/x86_64-linux-gnu/libnss_nis.so.2", O_RDONLY) = 3
open("/lib/x86_64-linux-gnu/libnss_files.so.2", O_RDONLY) = 3
open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3
open("/etc/shadow", O_RDONLY|O_CLOEXEC) = 3
open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3
open("/etc/shadow", O_RDONLY|O_CLOEXEC) = 3
open("/etc/passwd", O_RDONLY)           = 3
open("/etc/passwd", O_RDONLY)           = 3
open("/etc/.pwd.lock", O_WRONLY|O_CREAT|O_CLOEXEC, 0600) = 3
open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 4
open("/etc/shadow", O_RDONLY|O_CLOEXEC) = 4
open("/dev/urandom", O_RDONLY)          = 4
open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 4
open("/etc/passwd", O_RDONLY)           = 4
open("/etc/nshadow", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 4
open("/etc/shadow", O_RDONLY)           = 5
open("/etc/localtime", O_RDONLY)        = 4
Process 7760 attached
Process 7759 suspended
Process 7759 resumed
Process 7760 detached
--- SIGCHLD (Child exited) @ 0 (0) ---

EDIT4

Eventually I've run the same command on the same container on Debian Jessie and it worked.
The case is solved - Wheezy and Archlinux simply has different implementations of chpasswd.

I think the best portable workaround for this problem is as suggested by @Peter Cordes:

echo 'root:toor' | chroot /home/containers/wheezy/ /usr/sbin/chpasswd
0

It's likely Selinux / Ubuntu's alternative.

An excellent video on using selinux correctly: https://www.youtube.com/watch?v=bQqX3RWn0Yw

I'm not a Ubuntu (I think it's apparmor?) expert so I can't help there.

  • It's highly unlikely, as I don't have SELinux enabled on my Archlinux system. Further echo "root:toor" | sudo strace -f -efile,execve chpasswd --root /home/containers/wheezy starts throwing errors at open("/usr/share/locale/en_GB.UTF-8/LC_MESSAGES/Linux-PAM.mo", O_RDONLY) = -1 ENOENT (No such file or directory), so it definitely has something to do with PAM. – NarūnasK Aug 11 '15 at 22:59
  • Also, it's not an Ubuntu machine... – womble Aug 11 '15 at 23:10
  • Apologies then. Every time I have seen chroot throw issues accessing /etc/passwd or /etc/shadow it was selinux being picky.... If it helps, I have had better luck with passwd: echo 'NEWPASSWD' | chroot $chrt passwd root --stdin I'm not sure what PAM is upset about... The strace may be a valuable addition to the question itself. – Daniel Widrick Aug 11 '15 at 23:11
  • The good workaround with chroot is as follows: echo 'root:toor' | chroot /home/containers/wheezy/ /usr/sbin/chpasswd. Yes it works, but it doesn't explain, why the method from the book (man page) didn't. – NarūnasK Aug 12 '15 at 6:00
0

PAM is involved in password changes because that's how you do things like password strength checking. The password entries in your PAM configs control what is done.

My hypothesis in this situation is that it is a weird interaction between Arch and Debian. You're running the Arch chpasswd, which is doing a bunch of stuff (mostly loading shared libraries) and then jumping into the Wheezy container and trying to berk around with its configuration.

I think you'll have significantly better luck by just dropping the --root option off chpasswd and sticking a chroot call in front of it.

Also, just for completeness, you are running that chpasswd as root, right? (grin)

  • Yes, I run chpasswd as root, otherwise I wouldn't be able to change root's password and like I said it works fine on my local root user :) I agree with the rest of your statements, just not sure which of the PAM/locale packages might be missing on the base debian installation. Also please check my comment below @Daniel Widrick post. – NarūnasK Aug 12 '15 at 6:04

Not the answer you're looking for? Browse other questions tagged or ask your own question.