New issue
Advanced search Search tips

Issue 617385 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner: ----
Closed: Jun 2016
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 2
Type: Bug



Sign in to add a comment

PAM Authentication for CRD failed

Reported by 100271.2...@compuserve.com, Jun 4 2016

Issue description

UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.63 Safari/537.36

Steps to reproduce the problem:
1. Install google-chrome-stable_current_amd64.deb
2. Install chrome-remote-desktop_current_amd64.deb
3. configure remote connection with 6-digit pin code.

What is the expected behavior?
TO be able to establish a remote connection

What went wrong?
The access code is invalid. Please try again

WebStore page: Chrome Remote Desktop

Did this work before? N/A 

Chrome version: 51.0.2704.79  Channel: n/a
OS Version: Ubuntu_1604  3.12.6
Flash Version: Shockwave Flash 21.0 r0

I am trying to establish connection from a Win10 PC on the same LAN, same Subnet.

Remote assistance works just fine.
Remote connections fails with the error message: “The access code is invalid. Please try again”

Here are the last lines in the Chrome_Remote_Desktop Log:

2016-06-02 21:36:48,007:INFO:Host ready to receive connections.
[0602/213712:INFO:chromoting_host.cc(262)] Client connected: 3vipuf4wgjjkq@id.talk.google.com/chromoting4860B5C1
[0602/213717:INFO:pam_authorization_factory_posix.cc(128)] Local login check for admin failed.
[0602/213717:INFO:client_session.cc(337)] Client disconnected: 3vipuf4wgjjkq@id.talk.google.com/chromoting4860B5C1; error = 4
 
Owner: sergeyu@chromium.org
Status: Assigned (was: Unconfirmed)
+sergeyu for CRD.
Components: -Platform>Extensions Services>Chromoting
Owner: ----
Status: Untriaged (was: Assigned)

Comment 3 by dah...@chromium.org, Jun 28 2016

Cc: lambroslambrou@chromium.org
Is there anything special about how you setup or configured the admin account on the Linux machine? 

Lambros, please chime in if you have any other ideas about what could be causing this.
For Me2Me (not Remote Assistance) connections, we do a PAM local-login check to verify that the user who is running the host process has login rights to the machine.

The DEB package should install a PAM config at
/etc/pam.d/chrome-remote-desktop

so check that you still have that file installed.

The local-login check is implemented as a simple PAM conversation which checks
the result of pam_acct_mgmt().

Make sure the host process (chrome-remote-desktop-host) is running under your regular user account, not as root.

See the man-page for pam_acct_mgmt for more info about possible ways this check might fail: http://linux.die.net/man/3/pam_acct_mgmt

We have reports that Chrome Remote Desktop does work on Ubuntu 16.04, so it's probably an issue with your machine or account setup.

Thank you very much for taking the time to reply.
My Ubuntu runs in an LXC container. I log in as admin and all apps are installed using the admin account, not root.

The /etc/pam.d/chrome-remote-desktop file is present, and its content is only;

@include common-auth
@include common-account
@include common-password
@include common-session

Please provide guidance on what to do next in order to solve this issue.
Many thanks in advance.
The PAM config file looks correct. Check that the host process is running under user 'admin' using a command like
ps -ef | grep chrome-remote-desktop-host

Are you able to confirm if it works without LXC? It sounds like LXC might be somehow interfering with the PAM local-login check. I don't think there's any way to disable the check, other than to rebuild the host binary from source.

The PAM check is implemented here:
https://cs.chromium.org/chromium/src/remoting/host/pam_authorization_factory_posix.cc?q=IsLocalLoginAllowed&sq=package:chromium&dr=CSs&l=116

and this code runs inside the chrome-remote-desktop-host process.

If the problem is caused by LXC, you could perhaps find a support forum for LXC and show them this code, and see if they can help you configure PAM to make this test pass. LXC is not something we support ourselves.



The output is as follows;

ps -ef | grep chrome-remote-desktop-host

admin    16988  9492  0 14:36 pts/2    00:00:00 grep --color=auto chrome-remote-desktop-host
admin    25971 25947  0  \u516d 12 ?      00:00:33 /opt/google/chrome-remote-desktop/chrome-remote-desktop-host --host-config=- --audio-pipe-name=/home/admin/.config/chrome-remote-desktop/pulseaudio#d6e65c3e01/fifo_output --ssh-auth-sockname=/tmp/chromoting.admin.ssh_auth_sock --signal-parent

LXC is the only environment where I can run Ubuntu with a 'head'.
I'm running CRD from 2 other windows machines on the same LAN (same subnet), and they both work just fine.
That confirms chrome-remote-desktop-host is running as user admin.

Windows hosts are not affected - they don't execute the code that I linked to in comment #6.

I don't know what causes the PAM check to fail on your system - I can only guess it's somehow related to the LXC setup.

I'm sorry there's nothing I can offer beyond comment #6. I don't know how to configure your system to make the PAM check work for your environment, and we don't support LXC. I recommend you seek help from a LXC forum, and show them the code I linked to.

Ok, thank you anyway. You were the first person - after month of visiting forums and searching on the net - that were able to help at all.
Should you suddenly come to think of something, please do not hesitate to let me know. I'll continue my search :-)
Status: WontFix (was: Untriaged)

Sign in to add a comment