GNU bug report logs - #63198
cups-service-type uses PAM-enabled 'cups' by default which prevents authentication

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 63198 in the body.
You can then email your comments to 63198 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Maxim Cournoyer <maxim.cournoyer <at> gmail.com>
To: bug-guix <bug-guix <at> gnu.org>
Subject: cups-service-type uses PAM-enabled 'cups' by default which prevents
 authentication
Date: Sun, 30 Apr 2023 23:08:13 -0400

Hi,

Today I encountered an issue where after re-installing a Guix System, I
couldn't add a new printer anymore.  Any CUPS client (including the
trusty localhost:631 HTTP page) would loop on authenticating my user.

After consulting the logs and finding this kind of line:

--8<---------------cut here---------------start------------->8---
pam_authenticate() returned 7 (Authentication failure)
--8<---------------cut here---------------end--------------->8---

I started looking at our PAM configuration for CUPS, but we currently
have none, which is probably the issue.  Using 'cups-minimal' instead of
cups (which is built with linux-pam) solves the issue, as the 'cups'
value provided to the <cups-configuration> record.

We should probably make cups-minimal the default, or extend our
pam-service-type with the relevant PAM entries.

Thoughts/takers?

-- 
Thanks,
Maxim

Message #10 received at 63198-done <at> debbugs.gnu.org (full text, mbox):

From: Maxim Cournoyer <maxim.cournoyer <at> gmail.com>
To: 63198-done <at> debbugs.gnu.org
Subject: Re: bug#63198: cups-service-type uses PAM-enabled 'cups' by default
 which prevents authentication
Date: Wed, 03 May 2023 08:46:14 -0400

Hi,

Maxim Cournoyer <maxim.cournoyer <at> gmail.com> writes:

> Hi,
>
> Today I encountered an issue where after re-installing a Guix System, I
> couldn't add a new printer anymore.  Any CUPS client (including the
> trusty localhost:631 HTTP page) would loop on authenticating my user.
>
> After consulting the logs and finding this kind of line:
>
> pam_authenticate() returned 7 (Authentication failure)
>
> I started looking at our PAM configuration for CUPS, but we currently
> have none, which is probably the issue.  Using 'cups-minimal' instead of
> cups (which is built with linux-pam) solves the issue, as the 'cups'
> value provided to the <cups-configuration> record.

Fixed using the above strategy in 6bc3e3f ("services: cups: Use
cups-minimal to avoid PAM authentication.")

-- 
Thanks,
Maxim

Message #13 received at 63198 <at> debbugs.gnu.org (full text, mbox):

From: muradm <mail <at> muradm.net>
To: 63198 <at> debbugs.gnu.org
Subject: cups-service-type uses PAM-enabled 'cups' by default which prevents
 authentication
Date: Sat, 13 May 2023 16:43:40 +0300

[Message part 1 (text/plain, inline)]

Could you please elaborate more on "loop on authenticating my 
user"
from above and "prevents users from authenticating" from commit
message? Does it mean that you could not authenticate as your user
at all, or does it relates to authentication at 
http://localhost:631
for managing printers?

[signature.asc (application/pgp-signature, inline)]

Message #16 received at 63198 <at> debbugs.gnu.org (full text, mbox):

From: muradm <mail <at> muradm.net>
To: 63198 <at> debbugs.gnu.org
Subject: Re: cups-service-type uses PAM-enabled 'cups' by default which
 prevents authentication
Date: Sat, 13 May 2023 16:48:34 +0300

[Message part 1 (text/plain, inline)]

This change broke cups for me like this:

--8<---------------cut here---------------start------------->8---
I [13/May/2023:16:14:27 +0300] [Client 16] Started 
"/gnu/store/9kdm8k84j2xqlax4zaarchw00cfs62zz-cups-server-bin/lib/cups/daemon/cups-deviced" 
(pid=21409, file=14)
E [13/May/2023:16:14:27 +0300] [CGI] cups-brf must be called as 
root
E [13/May/2023:16:14:27 +0300] [cups-deviced] PID 21419 (cups-brf) 
stopped with status 1!
E [13/May/2023:16:14:27 +0300] [CGI] Unable to execute ippfind 
utility: No such file or directory
E [13/May/2023:16:14:27 +0300] [cups-deviced] PID 21421 
(driverless-fax) stopped with status 127!
--8<---------------cut here---------------end--------------->8---

cups-minimal does not include ippfind utility.

Normally, user whishing to use cups, should be in lp group, isn't 
it?
Maybe that was your original issue?

muradm <mail <at> muradm.net> writes:

> [[PGP Signed Part:Undecided]]
>
> Could you please elaborate more on "loop on authenticating my 
> user"
> from above and "prevents users from authenticating" from commit
> message? Does it mean that you could not authenticate as your 
> user
> at all, or does it relates to authentication at 
> http://localhost:631
> for managing printers?
>
> [[End of PGP Signed Part]]

[signature.asc (application/pgp-signature, inline)]

Message #19 received at 63198 <at> debbugs.gnu.org (full text, mbox):

From: muradm <mail <at> muradm.net>
To: 63198 <at> debbugs.gnu.org,
	maxim.cournoyer <at> gmail.com
Subject: [PATCH] services: cups: Add cups PAM service.
Date: Sat, 13 May 2023 21:38:00 +0300

Fixes <https://issues.guix.gnu.org/63198>.

Makes CUPS service to extend pam-root-service-type providing minimal
configuration to authenticate users. Since PAM authentication is
provided, cups package can be used as default.

* gnu/services/cups.scm (cups-configuration) [cups]: Use cups.
[allow-empty-password?]: PAM service configuration permitting empty passwords.
(opaque-cups-configuration): Likewise.
(cups-pam-service): cups PAM service.
(cups-service-type): Extend pam-root-service-type with cups-pam-service.
---
 gnu/services/cups.scm | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/gnu/services/cups.scm b/gnu/services/cups.scm
index c6099d77e7..d95c38b4d9 100644
--- a/gnu/services/cups.scm
+++ b/gnu/services/cups.scm
@@ -5,6 +5,7 @@
 ;;; Copyright © 2019 Alex Griffin <a <at> ajgrf.com>
 ;;; Copyright © 2019 Tobias Geerinckx-Rice <me <at> tobias.gr>
 ;;; Copyright © 2021 Maxime Devos <maximedevos <at> telenet.be>
+;;; Copyright © 2023 muradm <mail <at> muradm.net>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -25,6 +26,7 @@ (define-module (gnu services cups)
   #:use-module (gnu services)
   #:use-module (gnu services shepherd)
   #:use-module (gnu services configuration)
+  #:use-module (gnu system pam)
   #:use-module (gnu system shadow)
   #:use-module (gnu packages admin)
   #:use-module (gnu packages cups)
@@ -500,8 +502,11 @@ (define (serialize-package-list field-name val)
 
 (define-configuration cups-configuration
   (cups
-   (file-like cups-minimal)
+   (file-like cups)
    "The CUPS package.")
+  (allow-empty-password?
+   (boolean #f)
+   "Specifies whether empty passwords will be allowed when authenticating via PAM.")
   (extensions
    (package-list (list brlaser cups-filters epson-inkjet-printer-escpr
                        foomatic-filters hplip-minimal splix))
@@ -841,8 +846,11 @@ (define-configuration cups-configuration
 
 (define-configuration opaque-cups-configuration
   (cups
-   (package cups-minimal)
+   (package cups)
    "The CUPS package.")
+  (allow-empty-password?
+   (boolean #f)
+   "Specifies whether empty passwords will be allowed when authenticating via PAM.")
   (extensions
    (package-list '())
    "Drivers and other extensions to the CUPS package.")
@@ -1006,6 +1014,14 @@ (define (cups-shepherd-service config)
                            "-f" "-c" #$cupsd.conf "-s" #$cups-files.conf)))
            (stop #~(make-kill-destructor))))))
 
+(define (cups-pam-service config)
+  (let ((allow-empty-password?
+         (if (opaque-cups-configuration? config)
+             (opaque-cups-configuration-allow-empty-password? config)
+             (cups-configuration-allow-empty-password? config))))
+    (list (unix-pam-service "cups"
+                            #:allow-empty-passwords? allow-empty-password?))))
+
 (define cups-service-type
   (service-type (name 'cups)
                 (extensions
@@ -1013,6 +1029,8 @@ (define cups-service-type
                                           cups-shepherd-service)
                        (service-extension activation-service-type
                                           (const %cups-activation))
+                       (service-extension pam-root-service-type
+                                          cups-pam-service)
                        (service-extension account-service-type
                                           (const %cups-accounts))))
 

base-commit: ed1e7920393c9ae5b2ae31fc46bae88136239b13
-- 
2.40.1

Message #22 received at 63198 <at> debbugs.gnu.org (full text, mbox):

From: Maxim Cournoyer <maxim.cournoyer <at> gmail.com>
To: muradm <mail <at> muradm.net>
Cc: 63198 <at> debbugs.gnu.org
Subject: Re: bug#63198: cups-service-type uses PAM-enabled 'cups' by default
 which prevents authentication
Date: Mon, 15 May 2023 11:12:37 -0400

Hi,

muradm <mail <at> muradm.net> writes:

> Could you please elaborate more on "loop on authenticating my user"
> from above and "prevents users from authenticating" from commit
> message? Does it mean that you could not authenticate as your user
> at all, or does it relates to authentication at http://localhost:631
> for managing printers?

The later (could not authenticate with CUPS for say, adding a printer).

-- 
Thanks,
Maxim

Message #25 received at 63198 <at> debbugs.gnu.org (full text, mbox):

From: Maxim Cournoyer <maxim.cournoyer <at> gmail.com>
To: muradm <mail <at> muradm.net>
Cc: 63198 <at> debbugs.gnu.org
Subject: Re: bug#63198: cups-service-type uses PAM-enabled 'cups' by default
 which prevents authentication
Date: Mon, 15 May 2023 11:13:18 -0400

Hi,

muradm <mail <at> muradm.net> writes:

> This change broke cups for me like this:
>
> I [13/May/2023:16:14:27 +0300] [Client 16] Started 
> "/gnu/store/9kdm8k84j2xqlax4zaarchw00cfs62zz-cups-server-bin/lib/cups/daemon/cups-deviced" 
> (pid=21409, file=14)
> E [13/May/2023:16:14:27 +0300] [CGI] cups-brf must be called as 
> root
> E [13/May/2023:16:14:27 +0300] [cups-deviced] PID 21419 (cups-brf) 
> stopped with status 1!
> E [13/May/2023:16:14:27 +0300] [CGI] Unable to execute ippfind 
> utility: No such file or directory
> E [13/May/2023:16:14:27 +0300] [cups-deviced] PID 21421 
> (driverless-fax) stopped with status 127!
>
> cups-minimal does not include ippfind utility.
>
> Normally, user whishing to use cups, should be in lp group, isn't 
> it?
> Maybe that was your original issue?

No, as I tested adding my user to the lpr group without success.

-- 
Thanks,
Maxim

Message #28 received at 63198 <at> debbugs.gnu.org (full text, mbox):

From: Maxim Cournoyer <maxim.cournoyer <at> gmail.com>
To: muradm <mail <at> muradm.net>
Cc: 63198 <at> debbugs.gnu.org
Subject: Re: bug#63198: cups-service-type uses PAM-enabled 'cups' by default
 which prevents authentication
Date: Mon, 15 May 2023 11:24:19 -0400

Hi,

muradm <mail <at> muradm.net> writes:

> Fixes <https://issues.guix.gnu.org/63198>.
>
> Makes CUPS service to extend pam-root-service-type providing minimal
> configuration to authenticate users. Since PAM authentication is
> provided, cups package can be used as default.
>
> * gnu/services/cups.scm (cups-configuration) [cups]: Use cups.

I'd write 'Replace cups-minimal with cups'.

> [allow-empty-password?]: PAM service configuration permitting empty passwords.

I'd write 'New field', but I think we'd want to add proper PAM support
here not a 'bypass PAM authentication' hack.  It should also be enabled
out of the box, otherwise users won't be able to authenticate until they
figure out they need to set that switch to #t.

> (opaque-cups-configuration): Likewise.
> (cups-pam-service): cups PAM service.

Not descriptive :-)  What is the change here?

Could you look into adding "regular" login PAM support instead of a
bypass disabled by default?  The user should still be prompted for its
password, and it should go through the PAM auth module.

I'm not very PAM-aware, but I believe there are examples spread in the
code base.

-- 
Thanks,
Maxim

Message #31 received at 63198 <at> debbugs.gnu.org (full text, mbox):

From: muradm <mail <at> muradm.net>
To: Maxim Cournoyer <maxim.cournoyer <at> gmail.com>
Cc: 63198 <at> debbugs.gnu.org
Subject: Re: bug#63198: cups-service-type uses PAM-enabled 'cups' by default
 which prevents authentication
Date: Tue, 16 May 2023 08:17:56 +0300

[Message part 1 (text/plain, inline)]

Hello,

Maxim Cournoyer <maxim.cournoyer <at> gmail.com> writes:

> Hi,
>
> muradm <mail <at> muradm.net> writes:
>
>> Fixes <https://issues.guix.gnu.org/63198>.
>>
>> Makes CUPS service to extend pam-root-service-type providing 
>> minimal
>> configuration to authenticate users. Since PAM authentication 
>> is
>> provided, cups package can be used as default.
>>
>> * gnu/services/cups.scm (cups-configuration) [cups]: Use cups.
>
> I'd write 'Replace cups-minimal with cups'.
>

Sure you may change this.

>> [allow-empty-password?]: PAM service configuration permitting 
>> empty passwords.
>
> I'd write 'New field', but I think we'd want to add proper PAM 
> support
> here not a 'bypass PAM authentication' hack.  It should also be 
> enabled
> out of the box, otherwise users won't be able to authenticate 
> until they
> figure out they need to set that switch to #t.
>

Who ever touches PAM configuration knows that by default PAM does 
not
allow to authenticate users with empty passwords. This flag allows 
such
users. Just grep guix for allow-empty-password?, you will see that 
it
is all over the places.

>> (opaque-cups-configuration): Likewise.
>> (cups-pam-service): cups PAM service.
>
> Not descriptive :-)  What is the change here?
>

I used simlilar strategy as in your commit 6bc3e3f9ba :-) You are 
free
to reword as you wish.

> Could you look into adding "regular" login PAM support instead 
> of a
> bypass disabled by default?  The user should still be prompted 
> for its
> password, and it should go through the PAM auth module.
>
> I'm not very PAM-aware, but I believe there are examples spread 
> in the
> code base.

This patch provides necessary configuration for proper PAM 
support.
I decided to take screen-locker-service-type's configuration as
basis, since it is was most simpliest and adequate enough for this 
case.
This patch does not disables, baypasses or cheats PAM in any way.
User may navigate to CUPS portal. In the event of administrative
actions taken by user, CUPS portal asks user to authenticate.
With this configuration, it will attempt to authenticate as local
system user. In the event of proper system user/password supplied
and positively authenticated against PAM using "cups" service 
name,
user allowed to take administrative action. In the event of 
invalid
system user/password supplied, CUPS portal will keep looping
begging for password (just as in your original case). If user 
decides
to Cancel the authentication dialog, CUPS portal is navigated to
Unauthorized access informing page.

Why would I submit something that it is not working?

[signature.asc (application/pgp-signature, inline)]

Message #34 received at 63198 <at> debbugs.gnu.org (full text, mbox):

From: Ricardo Wurmus <rekado <at> elephly.net>
To: 63198 <at> debbugs.gnu.org, muradm <mail <at> muradm.net>, Maxim Cournoyer
 <maxim.cournoyer <at> gmail.com>
Subject: cups-service-type uses PAM-enabled 'cups' by default which prevents
 authentication
Date: Wed, 24 May 2023 00:14:18 +0200

I’ll second muradm: these changes broke my printing setup:

* my printer is no longer found because cups-minimal has minimal
  features and does not include dnssd
* I cannot add a new printer with ipp://192.168.x.x manually because of
  authentication problems.  The logs tell me that cups-brf needs to run
  as root.

As a bonus problem I cannot restart Cups with the “cups” package because
it cannot be killed.  I disabled the “cups” service and stopped it, but
cups still runs; killing it is of no use because it’s respawned
immediately.  Shepherd says it didn’t do it.  I also tried deleting the
cups socket file, but that also didn’t help.

-- 
Ricardo

Message #37 received at 63198-done <at> debbugs.gnu.org (full text, mbox):

From: Maxim Cournoyer <maxim.cournoyer <at> gmail.com>
To: muradm <mail <at> muradm.net>
Cc: Ricardo Wurmus <rekado <at> elephly.net>, 63198-done <at> debbugs.gnu.org
Subject: Re: bug#63198: cups-service-type uses PAM-enabled 'cups' by default
 which prevents authentication
Date: Tue, 23 May 2023 20:46:52 -0400

Hi muradm,

muradm <mail <at> muradm.net> writes:

[...]

>> Could you look into adding "regular" login PAM support instead of a
>> bypass disabled by default?  The user should still be prompted for
>> its
>> password, and it should go through the PAM auth module.
>>
>> I'm not very PAM-aware, but I believe there are examples spread in
>> the
>> code base.
>
> This patch provides necessary configuration for proper PAM support.
> I decided to take screen-locker-service-type's configuration as
> basis, since it is was most simpliest and adequate enough for this
> case.
> This patch does not disables, baypasses or cheats PAM in any way.
> User may navigate to CUPS portal. In the event of administrative
> actions taken by user, CUPS portal asks user to authenticate.
> With this configuration, it will attempt to authenticate as local
> system user. In the event of proper system user/password supplied
> and positively authenticated against PAM using "cups" service name,
> user allowed to take administrative action. In the event of invalid
> system user/password supplied, CUPS portal will keep looping
> begging for password (just as in your original case). If user decides
> to Cancel the authentication dialog, CUPS portal is navigated to
> Unauthorized access informing page.
>
> Why would I submit something that it is not working?

I didn't mean to imply that it didn't work; I just thought that it was
somehow bypassing PAM (and the original problem it caused in the first
place).  As I wrote earlier, I know next to nothing about PAM, and
misread your patch.

I've now installed the change.  Thanks for the fix, and thanks to
Ricardo for the reminder.

-- 
Maxim

Message #40 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Csepp <raingloom <at> riseup.net>
To: Ricardo Wurmus <rekado <at> elephly.net>
Cc: 63198 <at> debbugs.gnu.org, muradm <mail <at> muradm.net>, bug-guix <at> gnu.org,
 Maxim Cournoyer <maxim.cournoyer <at> gmail.com>
Subject: End-to-end tests Was: bug#63198: cups-service-type uses PAM-enabled
 'cups' by default which prevents authentication
Date: Wed, 24 May 2023 13:07:41 +0200

Ricardo Wurmus <rekado <at> elephly.net> writes:

> I’ll second muradm: these changes broke my printing setup:
>
> * my printer is no longer found because cups-minimal has minimal
>   features and does not include dnssd
> * I cannot add a new printer with ipp://192.168.x.x manually because of
>   authentication problems.  The logs tell me that cups-brf needs to run
>   as root.
>
> As a bonus problem I cannot restart Cups with the “cups” package because
> it cannot be killed.  I disabled the “cups” service and stopped it, but
> cups still runs; killing it is of no use because it’s respawned
> immediately.  Shepherd says it didn’t do it.  I also tried deleting the
> cups socket file, but that also didn’t help.

It might be a good idea to have more end-to-end tests in Guix that would
check if common operations like "finding a printer" work.  It's quite a
bit of up-front effort, but it's better than relying on manual testing
and could make things smoother in the long run.
SUSE has a cool testing framework based on screen captures, maybe it
could be adapted to Guix?

Message #46 received at submit <at> debbugs.gnu.org (full text, mbox):

From: muradm <mail <at> muradm.net>
To: Csepp <raingloom <at> riseup.net>
Cc: Ricardo Wurmus <rekado <at> elephly.net>, 63198 <at> debbugs.gnu.org,
 bug-guix <at> gnu.org, Maxim Cournoyer <maxim.cournoyer <at> gmail.com>
Subject: Re: End-to-end tests Was: bug#63198: cups-service-type uses
 PAM-enabled 'cups' by default which prevents authentication
Date: Wed, 24 May 2023 14:28:26 +0300

[Message part 1 (text/plain, inline)]

Csepp <raingloom <at> riseup.net> writes:

> Ricardo Wurmus <rekado <at> elephly.net> writes:
>
> It might be a good idea to have more end-to-end tests in Guix 
> that would
> check if common operations like "finding a printer" work.  It's 
> quite a
> bit of up-front effort, but it's better than relying on manual 
> testing
> and could make things smoother in the long run.
> SUSE has a cool testing framework based on screen captures, 
> maybe it
> could be adapted to Guix?

There is already test framework within Guix. You may find 
information at:
https://guix.gnu.org/manual/en/guix.html#Running-the-Test-Suite

In short, there are unit tests and system tests which can be found 
at
gnu/tests/*.scm for inspiration. It is just a matter of 
time/resource
availability to write tests.

For cups specifically, you may not need screen capture processing 
or
similar. It should be enough to use CLI tools available out of the 
box.

muradm

[signature.asc (application/pgp-signature, inline)]

Message #52 received at 63198-done <at> debbugs.gnu.org (full text, mbox):

From: muradm <mail <at> muradm.net>
To: Maxim Cournoyer <maxim.cournoyer <at> gmail.com>
Cc: Ricardo Wurmus <rekado <at> elephly.net>, 63198-done <at> debbugs.gnu.org
Subject: Re: bug#63198: cups-service-type uses PAM-enabled 'cups' by default
 which prevents authentication
Date: Wed, 24 May 2023 14:37:47 +0300

[Message part 1 (text/plain, inline)]

Hi Maxim,

Maxim Cournoyer <maxim.cournoyer <at> gmail.com> writes:

> Hi muradm,
>
> muradm <mail <at> muradm.net> writes:
>
> [...]
>
>>> Could you look into adding "regular" login PAM support instead 
>>> of a
>>> bypass disabled by default?  The user should still be prompted 
>>> for
>>> its
>>> password, and it should go through the PAM auth module.
>>>
>>> I'm not very PAM-aware, but I believe there are examples 
>>> spread in
>>> the
>>> code base.
>>
>> This patch provides necessary configuration for proper PAM 
>> support.
>> I decided to take screen-locker-service-type's configuration as
>> basis, since it is was most simpliest and adequate enough for 
>> this
>> case.
>> This patch does not disables, baypasses or cheats PAM in any 
>> way.
>> User may navigate to CUPS portal. In the event of 
>> administrative
>> actions taken by user, CUPS portal asks user to authenticate.
>> With this configuration, it will attempt to authenticate as 
>> local
>> system user. In the event of proper system user/password 
>> supplied
>> and positively authenticated against PAM using "cups" service 
>> name,
>> user allowed to take administrative action. In the event of 
>> invalid
>> system user/password supplied, CUPS portal will keep looping
>> begging for password (just as in your original case). If user 
>> decides
>> to Cancel the authentication dialog, CUPS portal is navigated 
>> to
>> Unauthorized access informing page.
>>
>> Why would I submit something that it is not working?
>
> I didn't mean to imply that it didn't work; I just thought that 
> it was
> somehow bypassing PAM (and the original problem it caused in the 
> first
> place).  As I wrote earlier, I know next to nothing about PAM, 
> and
> misread your patch.
>
> I've now installed the change.  Thanks for the fix, and thanks 
> to
> Ricardo for the reminder.

Cool, thanks!

[signature.asc (application/pgp-signature, inline)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.