1

How I am supposed to use systemd-ask-password-console.service? My aim is to trigger a password prompt and ask for input on some terminal.

Currently I am trying it like this:

  1. Start systemd-ask-password-console.service.
  2. Ensure that no other password agent is running: ps aux | grep ask
  3. Ensure that no other password agent is to be started: systemctl status systemd-ask*
  4. Execute systemd-ask-password --no-tty "Password:" to trigger the password agent.

Step 3 is waiting for an agent to return the password and finally times out. In the meantime the request can be seen within /run/systemd/ask-password/.

systemctl status systemd-ask-password-console.service shows:

● systemd-ask-password-console.service - Dispatch Password Requests to Console
   Loaded: loaded (/lib/systemd/system/systemd-ask-password-console.service; static; vendor preset: 
   Active: active (running) since Fri 2018-05-11 16:46:43 CEST; 6min ago
     Docs: man:systemd-ask-password-console.service(8)
 Main PID: 392 (systemd-tty-ask)
    Tasks: 2 (limit: 4915)
   CGroup: /system.slice/systemd-ask-password-console.service
       ├─392 /bin/systemd-tty-ask-password-agent --watch --console
       └─393 /bin/systemd-tty-ask-password-agent --watch --console=/dev/tty1

May 11 16:46:43 debian systemd[1]: Started Dispatch Password Requests to Console.

I would expect that the running agent processes the request and that it will use some terminal (e.g. tty1) to ask for the password.
What I am doing wrong?

2

systemd-ask-password-console.service is a system service that queries the user for system passwords (such as hard disk encryption keys and SSL certificate passphrases) on the console. It is intended to be used during boot to ensure proper handling of passwords necessary for boot. systemd-ask-password-wall.service is a system service that informs all logged in users for system passwords via wall(1). It is intended to be used after boot to ensure that users are properly notified.

https://www.freedesktop.org/software/systemd/man/systemd-ask-password-console.service.html

because it is not possible to reliably read from the console while another process (sh or login) is already reading from the console. More specifically, user input will be passed to only one process, and you cannot guess which process that will be.

  • I will accept your answer because you also pointed out why it is not expected to work after boot (after entering multi-user phase). – doak May 12 '18 at 12:45
  • Hence, to get some terminal password agent processing requests after boot, I will need to start an agent on a dedicated terminal. Once again, that should be possible with the already existing systemd agent. – doak May 12 '18 at 12:50
2

How I am supposed to use systemd-ask-password-console.service?

Long story short, you are not.

systemd-ask-password-console.service(8) is started automatically via its corresponding .path unit when someone makes an ask-password request. The ask-password agents are intended to be started simultaneously, and the agent which first reaches the user "wins".

I would expect that the running agent processes the request and that it will use some terminal (e.g. tty1) to ask for the password.

This is correct. However, it won't ask for input on "any" terminal, which is pretty much impossible in current Linux for reasons @sourcejedi stated in his answer.

Further reading

  • +1 For explicitly stating "no, it won't work" and pointing to the corresponding systemd documentation. – doak May 12 '18 at 12:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.