Your message dated Sat, 09 Feb 2013 13:40:36 +0100
with message-id <[email protected]>
and subject line Re: [Pkg-utopia-maintainers] Bug#700165: network-manager:
LDAP/SSSD user not authorized to control networking even if member of netdev
group
has caused the Debian Bug report #700165,
regarding network-manager: LDAP/SSSD user not authorized to control networking
even if member of netdev group
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
700165: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=700165
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: network-manager
Version: 0.9.4.0-10
Severity: normal
File: /usr/bin/nmcli
Usertags: pca.it-communication
Hi there!
Since I setup user authentication via LDAP/SSSD on my laptop I can no
longer activate NM connections as a such user:
=====
$ su
Password:
# ls -l /etc/NetworkManager/system-connections/FOSDEM
-rw------- 1 root root 134 Feb 2 13:24
/etc/NetworkManager/system-connections/FOSDEM
# exit
$ nmcli con up id FOSDEM
Error: Connection activation failed: Not authorized to control networking.
$ groups
Domain Users adm disk dialout cdrom floppy tape audio dip www-data video \
plugdev crontab netdev vlock kvm fuse libvirt lpadmin bacula scanner
clear clear_console
$ ck-list-sessions
Session1:
unix-user = '10000'
realname = 'Luca Capello'
seat = 'Seat2'
session-type = ''
active = FALSE
x11-display = ':0'
x11-display-device = '/dev/tty7'
display-device = ''
remote-host-name = ''
is-local = FALSE
on-since = '2013-02-08T07:22:35.394207Z'
login-session-id = '4294967295'
$
=====
The problem with ConsoleKit is well-known (see #665973). However,
according to /usr/share/doc/network-manager/README.Debian:
--8<---------------cut here---------------start------------->8---
system connections and security
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In NetworkManager version 0.9, network connections are stored as keyfiles in
the /etc/NetworkManager/system-connections/ directory.
When creating new wireless or wired connections, they are by default
system-owned (i.e. available to everyone) and the secrets (e.g WPA-PSK or WEP
key) are stored as plain text in the corresponding connection configuration
file. The advantage of system connections is, that they can be active before a
user has logged in and they are active across user sessions.
Modifying or creating such system-owned connections requires admin privileges.
To avoid prompts for the root/admin password, NetworkManager ships a PolicyKit
configuration file which grants everyone in group "netdev" or "sudo" the
privilege to modify a system connection without prior authentication.
--8<---------------cut here---------------end--------------->8---
Indeed the PolicyKit configuration seems to be correct, but the
LDAP/SSSD user does not have access to it (which should not be a
problem):
=====
$ cat
/etc/polkit-1/localauthority/10-vendor.d/org.freedesktop.NetworkManager.pkla
cat:
/etc/polkit-1/localauthority/10-vendor.d/org.freedesktop.NetworkManager.pkla:
Permission denied
$ su
Password:
# cat
/etc/polkit-1/localauthority/10-vendor.d/org.freedesktop.NetworkManager.pkla
[Adding or changing system-wide NetworkManager connections]
Identity=unix-group:netdev;unix-group:sudo
Action=org.freedesktop.NetworkManager.settings.modify.system
ResultAny=no
ResultInactive=no
ResultActive=yes
#
=====
What is strange is that the default user created by d-i (thus not
LDAP/SSSD) can control networking without any problem, thus I guess
there is something going wrong with SSSD. I have anyway reported it to
network-manager since this is the only package I have had problems with
so far.
Thx, bye,
Gismo / Luca
-- System Information:
Debian Release: 7.0
APT prefers unstable
APT policy: (990, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 3.7-trunk-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages network-manager depends on:
ii adduser 3.113+nmu3
ii dbus 1.6.8-1
ii dpkg 1.16.9
ii isc-dhcp-client 4.2.4-4
ii libc6 2.13-38
ii libdbus-1-3 1.6.8-1
ii libdbus-glib-1-2 0.100-1
ii libgcrypt11 1.5.0-3
ii libglib2.0-0 2.33.12+really2.32.4-5
ii libgnutls26 2.12.20-4
ii libgudev-1.0-0 175-7.1
ii libnl-3-200 3.2.7-4
ii libnl-genl-3-200 3.2.7-4
ii libnl-route-3-200 3.2.7-4
ii libnm-glib4 0.9.4.0-10
ii libnm-util2 0.9.4.0-10
ii libpolkit-gobject-1-0 0.105-3
ii libuuid1 2.20.1-5.3
ii lsb-base 4.1+Debian9
ii udev 175-7.1
ii wpasupplicant 1.0-3+b2
Versions of packages network-manager recommends:
pn crda <none>
ii dnsmasq-base 2.65-1
ii iptables 1.4.16.3-4
ii modemmanager 0.5.2.0-2
ii policykit-1 0.105-3
ii ppp 2.4.5-5.1+b1
Versions of packages network-manager suggests:
pn avahi-autoipd <none>
-- Configuration Files:
/etc/NetworkManager/NetworkManager.conf changed:
[main]
plugins=ifupdown,keyfile
[ifupdown]
managed=false
/etc/polkit-1/localauthority/10-vendor.d/org.freedesktop.NetworkManager.pkla
[Errno 13] Permission denied:
u'/etc/polkit-1/localauthority/10-vendor.d/org.freedesktop.NetworkManager.pkla'
-- no debconf information
pgp9EypOudYqB.pgp
Description: PGP signature
--- End Message ---
--- Begin Message ---
On 09.02.2013 12:40, Luca Capello wrote:
> active = FALSE
>
> The problem with ConsoleKit is well-known (see #665973). However,
> according to /usr/share/doc/network-manager/README.Debian:
Yes, you need to get your CK installation fixed.
Michael
--
Why is it that all of the instruments seeking intelligent life in the
universe are pointed away from Earth?
signature.asc
Description: OpenPGP digital signature
--- End Message ---
_______________________________________________
Pkg-utopia-maintainers mailing list
[email protected]
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/pkg-utopia-maintainers
