{"action":"created","issue":{"url":"https://api.github.com/repos/jupyter/jupyterhub/issues/486","repository_url":"https://api.github.com/repos/jupyter/jupyterhub","labels_url":"https://api.github.com/repos/jupyter/jupyterhub/issues/486/labels{/name}","comments_url":"https://api.github.com/repos/jupyter/jupyterhub/issues/486/comments","events_url":"https://api.github.com/repos/jupyter/jupyterhub/issues/486/events","html_url":"https://github.com/jupyter/jupyterhub/issues/486","id":142175235,"number":486,"title":"Login -> Logout -> Login fails","user":{"login":"vbraun","id":888729,"avatar_url":"https://avatars.githubusercontent.com/u/888729?v=3","gravatar_id":"","url":"https://api.github.com/users/vbraun","html_url":"https://github.com/vbraun","followers_url":"https://api.github.com/users/vbraun/followers","following_url":"https://api.github.com/users/vbraun/following{/other_user}","gists_url":"https://api.github.com/users/vbraun/gists{/gist_id}","starred_url":"https://api.github.com/users/vbraun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vbraun/subscriptions","organizations_url":"https://api.github.com/users/vbraun/orgs","repos_url":"https://api.github.com/users/vbraun/repos","events_url":"https://api.github.com/users/vbraun/events{/privacy}","received_events_url":"https://api.github.com/users/vbraun/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2016-03-20T15:50:30Z","updated_at":"2016-03-23T23:44:59Z","closed_at":null,"body":"I can login once but not twice. Jupyterhub 0.5.0 running under a single user with pam authentication\r\n~~~~\r\n$ ./jupyterhub --log-level=DEBUG\r\n[D 2016-03-20 16:45:56.367 JupyterHub application:529] Looking for ./jupyterhub_config in None\r\n[D 2016-03-20 16:45:56.367 JupyterHub application:549] Loaded config file: /home/vbraun-hub/JupyterHub/jupyterhub_config.py\r\n[I 2016-03-20 16:45:56.369 JupyterHub app:558] Loading cookie_secret from /home/vbraun-hub/JupyterHub/jupyterhub_cookie_secret\r\n[D 2016-03-20 16:45:56.369 JupyterHub app:623] Connecting to db: sqlite:///jupyterhub.sqlite\r\n[W 2016-03-20 16:45:56.390 JupyterHub app:292] \r\n    Generating CONFIGPROXY_AUTH_TOKEN. Restarting the Hub will require restarting the proxy.\r\n    Set CONFIGPROXY_AUTH_TOKEN env or JupyterHub.proxy_auth_token config to avoid this message.\r\n    \r\n[W 2016-03-20 16:45:56.393 JupyterHub app:685] No admin users, admin interface will be unavailable.\r\n[W 2016-03-20 16:45:56.393 JupyterHub app:686] Add any administrative users to `c.Authenticator.admin_users` in config.\r\n[I 2016-03-20 16:45:56.393 JupyterHub app:712] Not using whitelist. Any authenticated user will be allowed.\r\n[D 2016-03-20 16:45:56.400 JupyterHub app:787] Loaded users: \r\n    vbraun-hub\r\n[I 2016-03-20 16:45:56.405 JupyterHub app:1113] Hub API listening on http://127.0.0.1:8081/hub/\r\n[I 2016-03-20 16:45:56.408 JupyterHub app:860] Starting proxy @ http://*:443/\r\n[D 2016-03-20 16:45:56.408 JupyterHub app:861] Proxy cmd: ['configurable-http-proxy', '--ip', '', '--port', '443', '--api-ip', '127.0.0.1', '--api-port', '444', '--default-target', 'http://127.0.0.1:8081', '--ssl-key', 'letsencrypt/etc/live/vbraun.cc/privkey.pem', '--ssl-cert', 'letsencrypt/etc/live/vbraun.cc/cert.pem']\r\n16:45:56.542 - info: [ConfigProxy] Proxying https://*:443 to http://127.0.0.1:8081\r\n16:45:56.545 - info: [ConfigProxy] Proxy API at http://127.0.0.1:444/api/routes\r\n[D 2016-03-20 16:45:56.612 JupyterHub app:889] Proxy started and appears to be up\r\n[I 2016-03-20 16:45:56.612 JupyterHub app:1136] JupyterHub is now running at http://127.0.0.1:443/\r\n[W 2016-03-20 16:46:03.348 JupyterHub auth:383] Failed to open PAM session for vbraun-hub: [PAM Error 14] Cannot make/remove an entry for the specified session\r\n[I 2016-03-20 16:46:03.353 JupyterHub spawner:436] Spawning jupyterhub-singleuser --user=vbraun-hub --port=36298 --cookie-name=jupyter-hub-token-vbraun-hub --base-url=/user/vbraun-hub --hub-host= --hub-prefix=/hub/ --hub-api-url=http://127.0.0.1:8081/hub/api --ip=127.0.0.1\r\nFailed to set groups [Errno 1] Operation not permitted\r\n[D 2016-03-20 16:46:03.434 JupyterHub spawner:287] Polling subprocess every 30s\r\n[W 2016-03-20 16:46:03.808 vbraun-hub notebookapp:253] ipywidgets package not installed.  Widgets are unavailable.\r\n[I 2016-03-20 16:46:03.819 vbraun-hub notebookapp:1079] Serving notebooks from local directory: /home/vbraun-hub\r\n[I 2016-03-20 16:46:03.819 vbraun-hub notebookapp:1079] 0 active kernels \r\n[I 2016-03-20 16:46:03.819 vbraun-hub notebookapp:1079] The Jupyter Notebook is running at: http://127.0.0.1:36298/user/vbraun-hub/\r\n[I 2016-03-20 16:46:03.819 vbraun-hub notebookapp:1080] Use Control-C to stop this server and shut down all kernels (twice to skip confirmation).\r\n[I 2016-03-20 16:46:03.826 vbraun-hub log:47] 302 GET /user/vbraun-hub (127.0.0.1) 0.58ms\r\n[D 2016-03-20 16:46:03.827 JupyterHub utils:84] Server at http://127.0.0.1:36298/user/vbraun-hub responded with 302\r\n[I 2016-03-20 16:46:03.827 JupyterHub base:301] User vbraun-hub server took 0.738 seconds to start\r\n[I 2016-03-20 16:46:03.827 JupyterHub orm:159] Adding user vbraun-hub to proxy /user/vbraun-hub => http://127.0.0.1:36298\r\n[D 2016-03-20 16:46:03.829 JupyterHub orm:146] Fetching POST http://127.0.0.1:444/api/routes/user/vbraun-hub\r\n[D 2016-03-20 16:46:03.833 JupyterHub base:226] Setting cookie for vbraun-hub: jupyter-hub-token-vbraun-hub, {'secure': True}\r\n[D 2016-03-20 16:46:03.835 JupyterHub base:226] Setting cookie for vbraun-hub: jupyter-hub-token, {'secure': True}\r\n[I 2016-03-20 16:46:03.839 JupyterHub log:100] 302 POST /hub/login?next= (@::ffff:x.x.x.x) 791.45ms\r\n[I 2016-03-20 16:46:03.839 JupyterHub login:79] User logged in: vbraun-hub\r\n[D 2016-03-20 16:46:03.876 JupyterHub pages:29] User is running: /user/vbraun-hub\r\n[I 2016-03-20 16:46:03.880 JupyterHub log:100] 302 GET /hub/ (vbraun-hub@::ffff:x.x.x.x) 3.17ms\r\n[I 2016-03-20 16:46:03.914 vbraun-hub log:47] 302 GET /user/vbraun-hub (::ffff:x.x.x.x) 0.38ms\r\n[I 2016-03-20 16:46:03.963 JupyterHub log:100] 200 GET /hub/api/authorizations/cookie/jupyter-hub-token-vbraun-hub/[secret] (vbraun-hub@127.0.0.1) 7.26ms\r\n[I 2016-03-20 16:46:09.041 vbraun-hub log:47] 302 GET /user/vbraun-hub/logout (::ffff:x.x.x.x) 0.40ms\r\n[I 2016-03-20 16:46:09.079 JupyterHub login:17] User logged out: vbraun-hub\r\n[I 2016-03-20 16:46:09.084 JupyterHub log:100] 302 GET /hub/logout (vbraun-hub@::ffff:x.x.x.x) 5.37ms\r\n[I 2016-03-20 16:46:09.118 JupyterHub log:100] 302 GET /hub/ (@::ffff:x.x.x.x) 0.59ms\r\n[I 2016-03-20 16:46:09.174 JupyterHub log:100] 200 GET /hub/login (@::ffff:x.x.x.x) 20.75ms\r\n[W 2016-03-20 16:46:13.159 JupyterHub auth:372] PAM Authentication failed (@::ffff:x.x.x.x): [PAM Error 7] Authentication failure\r\n[D 2016-03-20 16:46:13.160 JupyterHub login:81] Failed login for None\r\n[I 2016-03-20 16:46:13.164 JupyterHub log:100] 200 POST /hub/login?next= (@::ffff:x.x.x.x) 1586.23ms\r\n~~~~\r\nThe \"Failed login for None\" was already suspicious in #485 "},"comment":{"url":"https://api.github.com/repos/jupyter/jupyterhub/issues/comments/200585327","html_url":"https://github.com/jupyter/jupyterhub/issues/486#issuecomment-200585327","issue_url":"https://api.github.com/repos/jupyter/jupyterhub/issues/486","id":200585327,"user":{"login":"vbraun","id":888729,"avatar_url":"https://avatars.githubusercontent.com/u/888729?v=3","gravatar_id":"","url":"https://api.github.com/users/vbraun","html_url":"https://github.com/vbraun","followers_url":"https://api.github.com/users/vbraun/followers","following_url":"https://api.github.com/users/vbraun/following{/other_user}","gists_url":"https://api.github.com/users/vbraun/gists{/gist_id}","starred_url":"https://api.github.com/users/vbraun/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vbraun/subscriptions","organizations_url":"https://api.github.com/users/vbraun/orgs","repos_url":"https://api.github.com/users/vbraun/repos","events_url":"https://api.github.com/users/vbraun/events{/privacy}","received_events_url":"https://api.github.com/users/vbraun/received_events","type":"User","site_admin":false},"created_at":"2016-03-23T23:44:59Z","updated_at":"2016-03-23T23:44:59Z","body":"Still doesn't explain the bug here, catching the PAM error should be perfectly fine. We are already logged in under the correct uid after all.\r\n\r\nThe `jupyterhub.auth.pre_spawn_start` is called from the same pid as the jupyterhub process, and it seems that pamela never forks anything. According to Lennart Poettering (quoted above) that is incorrect; The process calling `pam_open_session` loses SElinux permissions which can never be re-gained (thats the whole point of SElinux). Instead, Jupyterhub should fork before calling `pam_open_session` and then waitpid and then `pam_close_session` in the child."}}