Bug 34204 - Koha user needs to be able to login
Summary: Koha user needs to be able to login
Status: Pushed to oldstable
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Jonathan Druart
QA Contact: Testopia
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2023-07-05 15:18 UTC by Jonathan Druart
Modified: 2023-11-13 14:03 UTC (History)
5 users (show)

See Also:
Change sponsored?: ---
Patch complexity: ---
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:
23.11.00,23.05.05,22.11.12


Attachments
Bug 34204: Fix koha-shell under debian 12 (1.50 KB, patch)
2023-10-11 08:05 UTC, Jonathan Druart
Details | Diff | Splinter Review
Bug 34204: Fix koha-shell under debian 12 (1.55 KB, patch)
2023-10-17 18:58 UTC, David Nind
Details | Diff | Splinter Review
Bug 34204: Fix koha-shell under debian 12 (1.60 KB, patch)
2023-10-17 20:04 UTC, Chris Cormack
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Druart 2023-07-05 15:18:24 UTC
Found in bookworm:

root@kohadevbox:koha$ koha-shell kohadev
This account is currently not available.

This is because /etc/passwd has /usr/sbin/nologin as shell, which is coming from the --disabled-login param we passed to adduser in koha-create.

Looks like a bug has been fixed in adduser, because we didn't have this behavior in bullseye.

We should certainly remove this parameter.
Comment 1 Jonathan Druart 2023-07-05 15:31:14 UTC
I found a related discussion but not the diff that caused this change
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=625758
Comment 2 Jonathan Druart 2023-07-05 15:34:49 UTC
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=625758#72

"""
- change and document (adduser(8)) that --disabled-password will behave
  like --disabled-login and additionally set the shell to
  /usr/sbin/nologin.
"""


https://salsa.debian.org/debian/adduser/-/commit/427ade7d9116af5af7baa9d0c538e14fa86560cf
Comment 3 Jonathan Druart 2023-08-04 06:55:28 UTC
Make bookworm unusable in ktd.
Comment 4 David Cook 2023-09-12 00:40:54 UTC
Reading through that report... does that mean that we should be using "--disabled-password" instead?
Comment 5 Jonathan Druart 2023-10-11 08:05:22 UTC
Created attachment 156810 [details] [review]
Bug 34204: Fix koha-shell under debian 12

In Debian 12/Bookworm:
root@kohadevbox:koha$ koha-shell kohadev
This account is currently not available.

This is because /etc/passwd has /usr/sbin/nologin as shell, which is coming from the --disabled-login param we passed to adduser in koha-create.

Looks like a bug has been fixed in adduser, because we didn't have this behavior in bullseye.

Context:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=625758#72

"""
- change and document (adduser(8)) that --disabled-password will behave
  like --disabled-login and additionally set the shell to
  /usr/sbin/nologin.
"""
https://salsa.debian.org/debian/adduser/-/commit/427ade7d9116af5af7baa9d0c538e14fa86560cf

Test plan:
Confirm the above and that the change makes sense.
Comment 6 David Nind 2023-10-11 19:54:45 UTC
I had a go at testing and this is what I get (I don't get the message "This account is currently not available."):

david@david-thinkpad-t14:~/git-koha/koha-testing-docker$ ktd --root --shell 
root@kohadevbox:kohadevbox$ koha-shell kohadev
$ 

To get Debian Bookworm (Debian 12) I changed KOHA-IMAGE=master-bookworm (then a ktd pull).

cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
VERSION_CODENAME=bookworm
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
Comment 7 Jonathan Druart 2023-10-12 04:12:34 UTC
(In reply to David Nind from comment #6)
> I had a go at testing and this is what I get (I don't get the message "This
> account is currently not available."):
> 
> david@david-thinkpad-t14:~/git-koha/koha-testing-docker$ ktd --root --shell 
> root@kohadevbox:kohadevbox$ koha-shell kohadev
> $ 
> 
> To get Debian Bookworm (Debian 12) I changed KOHA-IMAGE=master-bookworm
> (then a ktd pull).

Yes, that's how it should be done.

What is the return of `grep kohadev /etc/passwd`
Comment 8 David Nind 2023-10-17 18:58:12 UTC
Created attachment 157279 [details] [review]
Bug 34204: Fix koha-shell under debian 12

In Debian 12/Bookworm:
root@kohadevbox:koha$ koha-shell kohadev
This account is currently not available.

This is because /etc/passwd has /usr/sbin/nologin as shell, which is coming from the --disabled-login param we passed to adduser in koha-create.

Looks like a bug has been fixed in adduser, because we didn't have this behavior in bullseye.

Context:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=625758#72

"""
- change and document (adduser(8)) that --disabled-password will behave
  like --disabled-login and additionally set the shell to
  /usr/sbin/nologin.
"""
https://salsa.debian.org/debian/adduser/-/commit/427ade7d9116af5af7baa9d0c538e14fa86560cf

Test plan:
Confirm the above and that the change makes sense.

Signed-off-by: David Nind <david@davidnind.com>
Comment 9 David Nind 2023-10-17 18:59:45 UTC
(In reply to Jonathan Druart from comment #7)
> 
> What is the return of `grep kohadev /etc/passwd`

I had another go at testing, and things seem to work as expected now. (Not sure what I did different this time!) Now signed off.

Testing notes (using KTD):

1. Before applying patch (after starting KTD with KOHA-IMAGE=master-bookworm):

ktd --root --shell
root@kohadevbox:kohadevbox$ koha-shell kohadev
This account is currently not available.
root@kohadevbox:kohadevbox$ grep kohadev /etc/passwd
kohadev-koha:x:1000:1000:Koha instance kohadev-koha,,,:/var/lib/koha/kohadev:/usr/sbin/nologin

2. After applying the patch (and shutting down then starting up KTD again):

david@david-thinkpad-t14:~/git-koha/koha-testing-docker$ ktd --root --shell
$ 
$ grep kohadev /etc/passwd
kohadev-koha:x:1000:1000:Koha instance kohadev-koha,,,:/var/lib/koha/kohadev:/bin/bash
Comment 10 Chris Cormack 2023-10-17 20:04:07 UTC
Created attachment 157288 [details] [review]
Bug 34204: Fix koha-shell under debian 12

In Debian 12/Bookworm:
root@kohadevbox:koha$ koha-shell kohadev
This account is currently not available.

This is because /etc/passwd has /usr/sbin/nologin as shell, which is coming from the --disabled-login param we passed to adduser in koha-create.

Looks like a bug has been fixed in adduser, because we didn't have this behavior in bullseye.

Context:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=625758#72

"""
- change and document (adduser(8)) that --disabled-password will behave
  like --disabled-login and additionally set the shell to
  /usr/sbin/nologin.
"""
https://salsa.debian.org/debian/adduser/-/commit/427ade7d9116af5af7baa9d0c538e14fa86560cf

Test plan:
Confirm the above and that the change makes sense.

Signed-off-by: David Nind <david@davidnind.com>
Signed-off-by: Chris Cormack <chris@bigballofwax.co.nz>
Comment 11 Tomás Cohen Arazi 2023-10-18 18:44:05 UTC
Pushed to master for 23.11.

Nice work everyone, thanks!
Comment 12 Fridolin Somers 2023-10-25 07:32:27 UTC
Pushed to 23.05.x for 23.05.05
Comment 13 Matt Blenkinsop 2023-11-13 14:03:15 UTC
Nice work everyone!

Pushed to oldstable for 22.11.x