{"action":"created","issue":{"url":"https://api.github.com/repos/linyows/octopass/issues/30","repository_url":"https://api.github.com/repos/linyows/octopass","labels_url":"https://api.github.com/repos/linyows/octopass/issues/30/labels{/name}","comments_url":"https://api.github.com/repos/linyows/octopass/issues/30/comments","events_url":"https://api.github.com/repos/linyows/octopass/issues/30/events","html_url":"https://github.com/linyows/octopass/issues/30","id":366185072,"node_id":"MDU6SXNzdWUzNjYxODUwNzI=","number":30,"title":"nsswitch configuration issue ","user":{"login":"sergpolly","id":6790270,"node_id":"MDQ6VXNlcjY3OTAyNzA=","avatar_url":"https://avatars3.githubusercontent.com/u/6790270?v=4","gravatar_id":"","url":"https://api.github.com/users/sergpolly","html_url":"https://github.com/sergpolly","followers_url":"https://api.github.com/users/sergpolly/followers","following_url":"https://api.github.com/users/sergpolly/following{/other_user}","gists_url":"https://api.github.com/users/sergpolly/gists{/gist_id}","starred_url":"https://api.github.com/users/sergpolly/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sergpolly/subscriptions","organizations_url":"https://api.github.com/users/sergpolly/orgs","repos_url":"https://api.github.com/users/sergpolly/repos","events_url":"https://api.github.com/users/sergpolly/events{/privacy}","received_events_url":"https://api.github.com/users/sergpolly/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-10-03T05:52:45Z","updated_at":"2018-10-06T14:34:22Z","closed_at":null,"author_association":"NONE","body":"Hi! I'm sorry to bother you again, but now I'm having trouble configuring Ubuntu `nsswitch`.\r\nI've tried many things but really have no idea how to fix it.\r\n\r\nThe symptoms are the following:\r\n - as soon as I mention `octopass` in the `/etc/nsswitch.conf` file following happens:\r\n      - I lose internet connection due to host/name resolution \r\n      - I cannot login into computer physically - the boot logo stays on the screen indefinitely (I recover from a bootable USB - by editing `/etc/nsswitch.conf`)\r\n      -  `octopass` can authenticate if cache `/var/cache/octopass` is present, but not anymore after I clean the cache\r\n - editing `/etc/ssh/sshd_config`, `/etc/pam.d/sshd` only - keeps the system fully functional, there is only 1 effect:\r\n     - I cannot `ssh` login with my regular (non-github) user using password\r\n\r\nHere are my config files (these are default Ubuntu configs + your edits from `octopass` README):\r\n\r\n```\r\nDistributor ID:\tUbuntu\r\nDescription:\tUbuntu 18.04 LTS\r\nRelease:\t18.04\r\nCodename:\tbionic\r\n4.15.0-20-generic #21-Ubuntu SMP Tue Apr 24 06:15:38 UTC 2018\r\n```\r\n\r\ndefault `/etc/ssh/sshd_config` + changes from README:\r\n```bash\r\n#\t$OpenBSD: sshd_config,v 1.101 2017/03/14 07:19:07 djm Exp $\r\n\r\n# This is the sshd server system-wide configuration file.  See\r\n# sshd_config(5) for more information.\r\n\r\n# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin\r\n\r\n# The strategy used for options in the default sshd_config shipped with\r\n# OpenSSH is to specify options with their default value where\r\n# possible, but leave them commented.  Uncommented options override the\r\n# default value.\r\n\r\n#Port 22\r\n#AddressFamily any\r\n#ListenAddress 0.0.0.0\r\n#ListenAddress ::\r\n\r\n#HostKey /etc/ssh/ssh_host_rsa_key\r\n#HostKey /etc/ssh/ssh_host_ecdsa_key\r\n#HostKey /etc/ssh/ssh_host_ed25519_key\r\n\r\n# Ciphers and keying\r\n#RekeyLimit default none\r\n\r\n# Logging\r\n#SyslogFacility AUTH\r\n#LogLevel INFO\r\n\r\n# Authentication:\r\n\r\n#LoginGraceTime 2m\r\n#PermitRootLogin prohibit-password\r\n#StrictModes yes\r\n#MaxAuthTries 6\r\n#MaxSessions 10\r\n\r\n#PubkeyAuthentication yes\r\n\r\n# Expect .ssh/authorized_keys2 to be disregarded by default in future.\r\n#AuthorizedKeysFile\t.ssh/authorized_keys .ssh/authorized_keys2\r\n\r\n#AuthorizedPrincipalsFile none\r\n\r\nAuthorizedKeysCommand /usr/bin/octopass\r\nAuthorizedKeysCommandUser root\r\n\r\n# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts\r\n#HostbasedAuthentication no\r\n# Change to yes if you don't trust ~/.ssh/known_hosts for\r\n# HostbasedAuthentication\r\n#IgnoreUserKnownHosts no\r\n# Don't read the user's ~/.rhosts and ~/.shosts files\r\n#IgnoreRhosts yes\r\n\r\n# To disable tunneled clear text passwords, change to no here!\r\nPasswordAuthentication no\r\n#PermitEmptyPasswords no\r\n\r\n# Change to yes to enable challenge-response passwords (beware issues with\r\n# some PAM modules and threads)\r\nChallengeResponseAuthentication no\r\n\r\n# Kerberos options\r\n#KerberosAuthentication no\r\n#KerberosOrLocalPasswd yes\r\n#KerberosTicketCleanup yes\r\n#KerberosGetAFSToken no\r\n\r\n# GSSAPI options\r\n#GSSAPIAuthentication no\r\n#GSSAPICleanupCredentials yes\r\n#GSSAPIStrictAcceptorCheck yes\r\n#GSSAPIKeyExchange no\r\n\r\n# Set this to 'yes' to enable PAM authentication, account processing,\r\n# and session processing. If this is enabled, PAM authentication will\r\n# be allowed through the ChallengeResponseAuthentication and\r\n# PasswordAuthentication.  Depending on your PAM configuration,\r\n# PAM authentication via ChallengeResponseAuthentication may bypass\r\n# the setting of \"PermitRootLogin without-password\".\r\n# If you just want the PAM account and session checks to run without\r\n# PAM authentication, then enable this but set PasswordAuthentication\r\n# and ChallengeResponseAuthentication to 'no'.\r\nUsePAM yes\r\n\r\n#AllowAgentForwarding yes\r\n#AllowTcpForwarding yes\r\n#GatewayPorts no\r\nX11Forwarding yes\r\n#X11DisplayOffset 10\r\n#X11UseLocalhost yes\r\n#PermitTTY yes\r\nPrintMotd no\r\n#PrintLastLog yes\r\n#TCPKeepAlive yes\r\n#UseLogin no\r\n#PermitUserEnvironment no\r\n#Compression delayed\r\n#ClientAliveInterval 0\r\n#ClientAliveCountMax 3\r\n#UseDNS no\r\n#PidFile /var/run/sshd.pid\r\n#MaxStartups 10:30:100\r\n#PermitTunnel no\r\n#ChrootDirectory none\r\n#VersionAddendum none\r\n\r\n# no default banner path\r\n#Banner none\r\n\r\n# Allow client to pass locale environment variables\r\nAcceptEnv LANG LC_*\r\n\r\n# override default of no subsystems\r\nSubsystem\tsftp\t/usr/lib/openssh/sftp-server\r\n\r\n# Example of overriding settings on a per-user basis\r\n#Match User anoncvs\r\n#\tX11Forwarding no\r\n#\tAllowTcpForwarding no\r\n#\tPermitTTY no\r\n#\tForceCommand cvs server\r\n\r\n```\r\ndefault `/etc/pam.d/sshd` + changes from the README:\r\n```bash\r\n# PAM configuration for the Secure Shell service\r\n\r\n# Standard Un*x authentication.\r\n#@include common-auth\r\n#@include common-auth\r\n\r\nauth requisite pam_exec.so quiet expose_authtok /usr/bin/octopass pam\r\nauth optional pam_unix.so not_set_pass use_first_pass nodelay\r\nsession required pam_mkhomedir.so skel=/etc/skel/ umask=0022\r\n\r\n\r\n# Disallow non-root logins when /etc/nologin exists.\r\naccount    required     pam_nologin.so\r\n\r\n# Uncomment and edit /etc/security/access.conf if you need to set complex\r\n# access limits that are hard to express in sshd_config.\r\n# account  required     pam_access.so\r\n\r\n# Standard Un*x authorization.\r\n@include common-account\r\n\r\n# SELinux needs to be the first session rule.  This ensures that any\r\n# lingering context has been cleared.  Without this it is possible that a\r\n# module could execute code in the wrong domain.\r\nsession [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so close\r\n\r\n# Set the loginuid process attribute.\r\nsession    required     pam_loginuid.so\r\n\r\n# Create a new session keyring.\r\nsession    optional     pam_keyinit.so force revoke\r\n\r\n# Standard Un*x session setup and teardown.\r\n@include common-session\r\n\r\n# Print the message of the day upon successful login.\r\n# This includes a dynamically generated part from /run/motd.dynamic\r\n# and a static (admin-editable) part from /etc/motd.\r\nsession    optional     pam_motd.so  motd=/run/motd.dynamic\r\nsession    optional     pam_motd.so noupdate\r\n\r\n# Print the status of the user's mailbox upon successful login.\r\nsession    optional     pam_mail.so standard noenv # [1]\r\n\r\n# Set up user limits from /etc/security/limits.conf.\r\nsession    required     pam_limits.so\r\n\r\n# Read environment variables from /etc/environment and\r\n# /etc/security/pam_env.conf.\r\nsession    required     pam_env.so # [1]\r\n# In Debian 4.0 (etch), locale-related environment variables were moved to\r\n# /etc/default/locale, so read that as well.\r\nsession    required     pam_env.so user_readenv=1 envfile=/etc/default/locale\r\n\r\n# SELinux needs to intervene at login time to ensure that the process starts\r\n# in the proper default security context.  Only sessions which are intended\r\n# to run in the user's context should be run after this.\r\nsession [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so open\r\n\r\n# Standard Un*x password updating.\r\n@include common-password\r\n```\r\n\r\nHere is just one of the `/etc/nsswitch.conf` that I've tried with `octopass`:\r\n```bash\r\n# /etc/nsswitch.conf\r\npasswd:         compat systemd octopass sss\r\ngroup:          compat systemd octopass sss\r\nshadow:         compat octopass sss\r\ngshadow:        files\r\n\r\nhosts:          files mdns4_minimal [NOTFOUND=return] dns\r\nnetworks:       files\r\n\r\nprotocols:      db files\r\nservices:       db files sss\r\nethers:         db files\r\nrpc:            db files\r\n\r\nnetgroup:       nis sss\r\nsudoers:        files sss\r\n```\r\nI've also tried :\r\n```bash\r\n...\r\npasswd:         files systemd octopass sss\r\ngroup:          files systemd octopass sss\r\nshadow:         files octopass sss\r\n...\r\n```\r\nand this ...\r\n```bash\r\n...\r\npasswd:         files octopass sss\r\ngroup:          files octopass sss\r\nshadow:         files octopass sss\r\n...\r\n```\r\nand some other combinations, but the thing is that they all break as long as `octopass` is present.\r\nAs soon as I remove `octopass` from `nsswitch.conf`, I can at least reboot the machine successfully and have internet access ...\r\nThe default Ubuntu `nsswitch.conf` looks like this:\r\n```bash\r\n\r\npasswd:         compat systemd\r\ngroup:          compat systemd\r\nshadow:         compat\r\ngshadow:        files\r\n\r\nhosts:          files mdns4_minimal [NOTFOUND=return] dns myhostname\r\nnetworks:       files\r\n\r\nprotocols:      db files\r\nservices:       db files\r\nethers:         db files\r\nrpc:            db files\r\n\r\nnetgroup:       nis\r\n```\r\n`sss` appeared there after I installed `sssd` - it's not present on Ubuntu by default. I haven't configured `sssd` in any way.\r\nBut looks like it works for people on Ubuntu/Debian even without `sss`:\r\nhttps://github.com/uchida/ansible-octopass-role/blob/8060217c655abdd78e29aa4b34e900d754d15f7a/tasks/debian.yml#L59\r\n\r\n\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/linyows/octopass/issues/comments/427578403","html_url":"https://github.com/linyows/octopass/issues/30#issuecomment-427578403","issue_url":"https://api.github.com/repos/linyows/octopass/issues/30","id":427578403,"node_id":"MDEyOklzc3VlQ29tbWVudDQyNzU3ODQwMw==","user":{"login":"linyows","id":72049,"node_id":"MDQ6VXNlcjcyMDQ5","avatar_url":"https://avatars1.githubusercontent.com/u/72049?v=4","gravatar_id":"","url":"https://api.github.com/users/linyows","html_url":"https://github.com/linyows","followers_url":"https://api.github.com/users/linyows/followers","following_url":"https://api.github.com/users/linyows/following{/other_user}","gists_url":"https://api.github.com/users/linyows/gists{/gist_id}","starred_url":"https://api.github.com/users/linyows/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/linyows/subscriptions","organizations_url":"https://api.github.com/users/linyows/orgs","repos_url":"https://api.github.com/users/linyows/repos","events_url":"https://api.github.com/users/linyows/events{/privacy}","received_events_url":"https://api.github.com/users/linyows/received_events","type":"User","site_admin":false},"created_at":"2018-10-06T14:34:22Z","updated_at":"2018-10-06T14:34:22Z","author_association":"OWNER","body":"Can you reproduce with docker container?"}}
{"actor":{"display_login":"linyows"}}