PAM Authentication for CRD failed
Reported by
100271.2...@compuserve.com,
Jun 4 2016
|
||||
Issue descriptionUserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.63 Safari/537.36 Steps to reproduce the problem: 1. Install google-chrome-stable_current_amd64.deb 2. Install chrome-remote-desktop_current_amd64.deb 3. configure remote connection with 6-digit pin code. What is the expected behavior? TO be able to establish a remote connection What went wrong? The access code is invalid. Please try again WebStore page: Chrome Remote Desktop Did this work before? N/A Chrome version: 51.0.2704.79 Channel: n/a OS Version: Ubuntu_1604 3.12.6 Flash Version: Shockwave Flash 21.0 r0 I am trying to establish connection from a Win10 PC on the same LAN, same Subnet. Remote assistance works just fine. Remote connections fails with the error message: “The access code is invalid. Please try again” Here are the last lines in the Chrome_Remote_Desktop Log: 2016-06-02 21:36:48,007:INFO:Host ready to receive connections. [0602/213712:INFO:chromoting_host.cc(262)] Client connected: 3vipuf4wgjjkq@id.talk.google.com/chromoting4860B5C1 [0602/213717:INFO:pam_authorization_factory_posix.cc(128)] Local login check for admin failed. [0602/213717:INFO:client_session.cc(337)] Client disconnected: 3vipuf4wgjjkq@id.talk.google.com/chromoting4860B5C1; error = 4
,
Jun 27 2016
,
Jun 28 2016
Is there anything special about how you setup or configured the admin account on the Linux machine? Lambros, please chime in if you have any other ideas about what could be causing this.
,
Jun 28 2016
For Me2Me (not Remote Assistance) connections, we do a PAM local-login check to verify that the user who is running the host process has login rights to the machine. The DEB package should install a PAM config at /etc/pam.d/chrome-remote-desktop so check that you still have that file installed. The local-login check is implemented as a simple PAM conversation which checks the result of pam_acct_mgmt(). Make sure the host process (chrome-remote-desktop-host) is running under your regular user account, not as root. See the man-page for pam_acct_mgmt for more info about possible ways this check might fail: http://linux.die.net/man/3/pam_acct_mgmt We have reports that Chrome Remote Desktop does work on Ubuntu 16.04, so it's probably an issue with your machine or account setup.
,
Jun 29 2016
Thank you very much for taking the time to reply. My Ubuntu runs in an LXC container. I log in as admin and all apps are installed using the admin account, not root. The /etc/pam.d/chrome-remote-desktop file is present, and its content is only; @include common-auth @include common-account @include common-password @include common-session Please provide guidance on what to do next in order to solve this issue. Many thanks in advance.
,
Jun 29 2016
The PAM config file looks correct. Check that the host process is running under user 'admin' using a command like ps -ef | grep chrome-remote-desktop-host Are you able to confirm if it works without LXC? It sounds like LXC might be somehow interfering with the PAM local-login check. I don't think there's any way to disable the check, other than to rebuild the host binary from source. The PAM check is implemented here: https://cs.chromium.org/chromium/src/remoting/host/pam_authorization_factory_posix.cc?q=IsLocalLoginAllowed&sq=package:chromium&dr=CSs&l=116 and this code runs inside the chrome-remote-desktop-host process. If the problem is caused by LXC, you could perhaps find a support forum for LXC and show them this code, and see if they can help you configure PAM to make this test pass. LXC is not something we support ourselves.
,
Jun 30 2016
The output is as follows; ps -ef | grep chrome-remote-desktop-host admin 16988 9492 0 14:36 pts/2 00:00:00 grep --color=auto chrome-remote-desktop-host admin 25971 25947 0 \u516d 12 ? 00:00:33 /opt/google/chrome-remote-desktop/chrome-remote-desktop-host --host-config=- --audio-pipe-name=/home/admin/.config/chrome-remote-desktop/pulseaudio#d6e65c3e01/fifo_output --ssh-auth-sockname=/tmp/chromoting.admin.ssh_auth_sock --signal-parent LXC is the only environment where I can run Ubuntu with a 'head'. I'm running CRD from 2 other windows machines on the same LAN (same subnet), and they both work just fine.
,
Jun 30 2016
That confirms chrome-remote-desktop-host is running as user admin. Windows hosts are not affected - they don't execute the code that I linked to in comment #6. I don't know what causes the PAM check to fail on your system - I can only guess it's somehow related to the LXC setup. I'm sorry there's nothing I can offer beyond comment #6. I don't know how to configure your system to make the PAM check work for your environment, and we don't support LXC. I recommend you seek help from a LXC forum, and show them the code I linked to.
,
Jun 30 2016
Ok, thank you anyway. You were the first person - after month of visiting forums and searching on the net - that were able to help at all. Should you suddenly come to think of something, please do not hesitate to let me know. I'll continue my search :-)
,
Jun 30 2016
|
||||
►
Sign in to add a comment |
||||
Comment 1 by lazyboy@chromium.org
, Jun 24 2016Status: Assigned (was: Unconfirmed)