#52533 - guix deploy breaks SSH access with a PAM error

Package	Source(s)		Maintainer(s)
guix		PTS Buildd Popcon

Message #8 received at 52533@debbugs.gnu.org (full text, mbox, reply):

Received: (at 52533) by debbugs.gnu.org; 16 Dec 2021 05:27:59 +0000
From debbugs-submit-bounces@debbugs.gnu.org Thu Dec 16 00:27:59 2021
Received: from localhost ([127.0.0.1]:34241 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1mxjJ9-0004X4-ED
	for submit@debbugs.gnu.org; Thu, 16 Dec 2021 00:27:59 -0500
Received: from mail-qt1-f182.google.com ([209.85.160.182]:33441)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <maxim.cournoyer@gmail.com>) id 1mxjJ7-0004Wr-Ms
 for 52533@debbugs.gnu.org; Thu, 16 Dec 2021 00:27:58 -0500
Received: by mail-qt1-f182.google.com with SMTP id n15so24394697qta.0
 for <52533@debbugs.gnu.org>; Wed, 15 Dec 2021 21:27:57 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112;
 h=from:to:subject:references:date:in-reply-to:message-id:user-agent
 :mime-version; bh=1/5D2XMOtdgfB6pXBHH6H0FhU3cebn6QIEwFHE13S4U=;
 b=CUQYD8gInpYnBrHod3dLWvgzJe4G8GSnEzrYblwsF/duxiVn301lquJR86DJDXgAyX
 sSFvR5AeNleXB+worxSrd75pmTvykY60mSmZjHrUX968kgxYROtXVJUwQppG5zTZ5zPG
 MSO+VGZMIbtiVcilVgxqJ+jJO9VFIBHBB92kScdiWz35eVVGLTWL3PtWfVUkr0kKdw/u
 2mmAU28mQm1Vz2D2PlXwZ1kV+Aij86OV7tGuEoRSjiOL2coEvKLsR3LYcbcWIInxLN/W
 uPtQRpk+yUgZt996M6jbn/snGWGYvtZJdctu3emlV+qpwbT7XaHowJwqO5PE15ILb4Q0
 mbdA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20210112;
 h=x-gm-message-state:from:to:subject:references:date:in-reply-to
 :message-id:user-agent:mime-version;
 bh=1/5D2XMOtdgfB6pXBHH6H0FhU3cebn6QIEwFHE13S4U=;
 b=aRUpWIzfcicBGbUgCgFa3kvIaH43bzQovF1DCxNcq7tewVXL6AqGm9k0NI0Kq/8nnU
 O7C6s8l67mz778wunnevMjbfGjFBBddio+KR06wUhfaNPRrraRlpCsGhObTMm88VspQd
 n2zqjuHBM1qt+iZWDJObKbcuHN6NWUJLgsc+gDG6caVsG337Pl/dSLT+eEktJidBQpVa
 eKUE1pJI9nkdLXgJdy/ZcBFEfoTC544uXOwpC5vOQ+NKvKqiuD0IFjMSOC4+NtRMeJRU
 WO2iSpJgEnjd1Qb9NSruR1m5+1pxogdh+Tf4MjESOfWXeESYAXjF8oJhHHjXAfI9z6tB
 ykiQ==
X-Gm-Message-State: AOAM531E4hroS80H2H6XgvgfmSb3fATkKeyfTI3KWatxAL/pW+nQ73mD
 6GLtuH2Dyky+kDQHLm3PTtso9E6GEIk=
X-Google-Smtp-Source: ABdhPJzjolceWnv0XKL/Ve7wMLdObXfRxQjT58WbXDw+J0wqS/Ub2wcrBNc/t62ZXGnNINxJAytvxA==
X-Received: by 2002:ac8:5781:: with SMTP id v1mr15854879qta.254.1639632471696; 
 Wed, 15 Dec 2021 21:27:51 -0800 (PST)
Received: from hurd (dsl-10-146-110.b2b2c.ca. [72.10.146.110])
 by smtp.gmail.com with ESMTPSA id e13sm2021264qte.51.2021.12.15.21.27.50
 for <52533@debbugs.gnu.org>
 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
 Wed, 15 Dec 2021 21:27:51 -0800 (PST)
From: Maxim Cournoyer <maxim.cournoyer@gmail.com>
To: 52533@debbugs.gnu.org
Subject: [PATCH] bug#52533: guix deploy breaks SSH access with a PAM error
References: <87czlx88ez.fsf@gmail.com>
Date: Thu, 16 Dec 2021 00:27:50 -0500
In-Reply-To: <87czlx88ez.fsf@gmail.com> (Maxim Cournoyer's message of "Wed, 15
 Dec 2021 23:45:24 -0500")
Message-ID: <878rwl86g9.fsf@gmail.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.2 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
X-Spam-Score: -0.0 (/)
X-Debbugs-Envelope-To: 52533
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

Hello,

I've found a workaround: disabling PAM for the remote machine
ssh-daemon.  This is not done as part of 'guix deploy', so needs to be
fiddled with manually; I did it this way:

1. take note of the command line and sshd_config file:

--8<---------------cut here---------------start------------->8---
ps -eFww | grep sshd
--8<---------------cut here---------------end--------------->8---

2. Copy the sshd_config file from /gnu/store to somewhere writable and
edit it so tha UsePAM is "no" instead of "yes".

3. Stop the Shepherd service with 'sudo herd stop ssh-daemon'

4. Start the ssh daemon manually (with sudo) by using the command found
in 1. but with the edited config from 2.

Then you should be able to 'guix deploy' successfully.

Reading 'man sshd_config', it says the default for UsePAM is no.
Considering this, and the issue it caused reported here, perhaps we
should disable it by default in Guix?

What do others think?

Thank you,

Maxim

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Tue Sep 9 15:43:15 2025; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#52533 guix deploy breaks SSH access with a PAM error