Your message dated Fri, 04 Sep 2026 12:52:25 +0000
with message-id <[email protected]>
and subject line Bug#1146686: fixed in barman 3.20.0-2
has caused the Debian Bug report #1146686,
regarding barman: locked barman account (sysusers u!) makes cron refuse all
jobs for the account
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1146686: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1146686
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: barman
Version: 3.20.0-1
Severity: normal
Tags: patch
Dear Maintainer,
Since 3.20.0-1, the barman package creates the "barman" system account
as a *locked* account, via the new /usr/lib/sysusers.d/barman.conf:
u! barman - "Backup and Recovery Manager for PostgreSQL" /var/lib/barman
/bin/bash
systemd implements the "!" modifier by writing 1 into the shadow expiry
field, so the account is expired since 1970-01-02:
# getent shadow barman
barman:!*:20700:::::1:
# chage -l barman | grep -i 'Account expires'
Account expires : Jan 02, 1970
pam_unix's account module then refuses *every* PAM session for the
account, not only interactive logins. That includes cron. On a stock
install, with no local configuration at all, cron therefore logs this
once a minute, caused by the package's own /etc/cron.d/barman:
CRON[2255]: pam_unix(cron:account): account barman has expired (account
expired)
CRON[2257]: pam_unix(cron:account): account barman has expired (account
expired)
and su(1) to the account no longer works:
# su -s /bin/bash barman -c id
Your account has expired; please contact your system administrator.
su: Authentication failure
I believe this is not what "u!" is meant to achieve here.
sysusers.d(5) documents the modifier as being about *login*:
"may be suffixed with an exclamation mark ("u!") to create a fully
locked account. This is recommended, since logins should typically
not be allowed for system users. With or without the exclamation
mark an invalid password is set. For "u!", the account is also
locked, which makes a difference for non-password forms of
authentication, such as SSH or similar."
Blocking logins and SSH is reasonable for barman. Blocking cron is not,
because scheduling barman through cron as the barman user is both the
documented way to use barman and what this very package ships in
/etc/cron.d/barman.
Impact
------
Two effects, one cosmetic and one not:
1. Every trixie/sid system with barman installed logs an authentication
failure once a minute. The package's own cron.d entry is a no-op
under systemd (it defers to barman.timer), but cron still runs the
PAM account check before evaluating the command, so the refusal is
logged regardless.
2. Any cron job that runs as the barman user is silently refused. This
is the part that actually breaks things. I hit it through a
third-party tool that schedules "barman cron" from /etc/cron.d as
the barman user: "barman archive-wal" never ran, so no WAL segment
was ever moved from streaming/ into wals/, and the tool's
provisioning timed out waiting for the first archived segment. The
only symptom is the PAM line above, which makes it quite hard to
diagnose.
I did not test a non-systemd installation, so I cannot say what
happens there. It is worth checking, though, since the body of the
package's own /etc/cron.d/barman entry is guarded to run only when
systemd is *not* the init system, and that entry also runs as the
barman user.
Steps to reproduce
------------------
Reproduced in a Docker container booted with systemd from the official
debian:sid image, so the kernel named in the system information below
is the container host's kernel rather than a Debian one. Nothing in
what follows depends on the kernel.
On a stock Debian unstable system with systemd:
# apt-get install barman cron
# chage -l barman | grep -i 'Account expires'
Account expires : Jan 02, 1970
# systemctl start cron
# sleep 120
# journalctl -u cron | grep barman
CRON[2255]: pam_unix(cron:account): account barman has expired (account
expired)
Clearing the expiry is enough to make cron work again, which confirms
the chain:
# chage -E -1 barman
# sleep 70
# journalctl -u cron | grep barman
CRON[2431]: pam_unix(cron:session): session opened for user barman(uid=993)
CRON[2433]: (barman) CMD (test -d /run/systemd/system || { ... barman -q
cron; })
Affected versions
-----------------
Only 3.20.0-1 (unstable), which introduced the sysusers.d file.
3.19.1-3 (testing) and 3.13.3-1 (trixie) ship no sysusers.d file and
create the account without an expiry, so they are unaffected. As it
stands, the problem would reach testing with 3.20.0-1.
Note the apt.postgresql.org rebuilds carry the same change, so the
issue is also present on trixie via barman 3.20.0-1.pgdg13+1. That is
where I first saw it; I then reproduced it on unstable with the
official package, which is what is reported above.
Possible fix
------------
Use plain "u" rather than "u!" in debian/barman.sysusers. An invalid
password is set either way, so password logins remain impossible, and
the shell could be changed to /usr/sbin/nologin if interactive logins
should be prevented outright. That keeps cron and su working for the
service account.
--- a/debian/barman.sysusers
+++ b/debian/barman.sysusers
@@ -1 +1 @@
-u! barman - "Backup and Recovery Manager for PostgreSQL" /var/lib/barman
/bin/bash
+u barman - "Backup and Recovery Manager for PostgreSQL" /var/lib/barman
/bin/bash
Note that this will not repair systems that already installed
3.20.0-1. I checked: once the expiry is cleared, neither re-running
"systemd-sysusers barman.conf" nor reinstalling the package sets it
again, because systemd-sysusers leaves the shadow fields of an
existing account alone. Conversely, that means an already-installed
system keeps the expired account after the fix, so it may be worth
clearing the expiry in postinst for the affected version.
Alternatively, if the locked account is deliberate, then the package
should stop relying on cron running as the barman user, and
/etc/cron.d/barman should be dropped or reworked, since it cannot work
on the non-systemd systems it exists to serve.
Thanks for maintaining barman.
-- System Information:
Debian Release: forky/sid
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.17.0-40-generic (SMP w/16 CPU threads; PREEMPT)
Kernel taint flags: TAINT_WARN, TAINT_OOT_MODULE
Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages barman depends on:
ii file 1:5.47-4
ii python3 3.14.7-3
ii python3-barman 3.20.0-1
ii rsync 3.5.0+ds1-2
ii systemd [systemd-tmpfiles] 262~rc1-2
Versions of packages barman recommends:
ii openssh-client 1:10.5p1-1
ii openssh-server 1:10.5p1-1
pn polkitd <none>
ii postgresql-client 18+293
ii postgresql-client-18 [postgresql-client] 18.6-3
ii python3-argcomplete 3.7.0-1
Versions of packages barman suggests:
pn barman-cli <none>
pn repmgr <none>
-- no debconf information
Jonathan Renon
Principal Engineer
+33 6 79 25 88 03
[email protected]
enterprisedb.com
--- End Message ---
--- Begin Message ---
Source: barman
Source-Version: 3.20.0-2
Done: Marco Nenciarini <[email protected]>
We believe that the bug you reported is fixed in the latest version of
barman, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Marco Nenciarini <[email protected]> (supplier of updated barman package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 04 Sep 2026 14:09:43 +0200
Source: barman
Architecture: source
Version: 3.20.0-2
Distribution: unstable
Urgency: medium
Maintainer: Marco Nenciarini <[email protected]>
Changed-By: Marco Nenciarini <[email protected]>
Closes: 1146686
Changes:
barman (3.20.0-2) unstable; urgency=medium
.
* Fix barman account lockout from sysusers "u!" (Closes: #1146686)
Checksums-Sha1:
6467d4d030b97364fba6478dded90c5f8af4750a 2223 barman_3.20.0-2.dsc
e10f3acf4d9f4de829bea8f7298a149d063fc0cc 23268 barman_3.20.0-2.debian.tar.xz
c5070ef91335b0e3940a2589ce3d06d76f52459d 7168 barman_3.20.0-2_amd64.buildinfo
Checksums-Sha256:
1f3000ee3c2d6cb663ce6c14e28a32ee7073c4ede6ccbad65bfe20b35017a674 2223
barman_3.20.0-2.dsc
ac57fbe465d0a54ea6b7d8d73f61fc3cefdea5918630b681762b45ec59daff12 23268
barman_3.20.0-2.debian.tar.xz
56512333ea4350d31d7a0bd59f252f1f39fe4ca291407154626c0e376493ade0 7168
barman_3.20.0-2_amd64.buildinfo
Files:
feeb19bfc06c8f491fa755c6b44192a6 2223 database optional barman_3.20.0-2.dsc
627555c8ee32b48a78093428f9dd2794 23268 database optional
barman_3.20.0-2.debian.tar.xz
158002b6d245d5e6af3a3af8cad93b39 7168 database optional
barman_3.20.0-2_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEfCO4BD5l0pgKIbbiWJ8D8BulUDgFAmqauTMACgkQWJ8D8Bul
UDiThxAAjorwnE5TJX3n67q9GktQ54O9u9ddAn7cQP1URmj3vCMn1lwb6/eOJFfJ
EoPprFQwp0AlhurutyTaTWzK/O82E9DVR8lnJhPek9GUjj3ehqId4KhMpmg4fBvx
ffrWo3joKagW+YlsENK1s4tSbfBFNmn18lqZgE0sgn8NO2tUr4BHOuWxL/iuvJd3
U0rdvvMkpI4dPwaWVuW4keMAyMADgtBdJY7iGHeAoNS8qWKYSd2cB+kBm6JdYkN9
xu4lS1Z40HL9wIsrTnya2vidtuJNe3RsYIQg2zus9uksCcHEABIJ7EXjVP8aD0mO
DKANt6QOTc/CIYpQPqf021OpZrzOuRMgpQOuLEvK/I7xYMQJIWW1yNPqbgJdGV8i
qEXWpw8BgGKdQybLXDKGHPVuKgwPrb6Ozip/kbflduRN5mkVsqPVeGjtk+G4NiRr
0oQMyUr/AqUlJljNm3BkONn/4bqbRP+bSoKCNmHDZqmMHP4m1mY3wsDHSDEbc7GX
o6AMONJJf7z9bP2BQuXnToZcI/B3WsiklrxhsxvY+s5jDEWAbvKLtcAdgTUyJtQ6
hWrud6bCkpCyjWHaZaUUDxH2lgw7AYzAEuQ9DhL8sCVFjreeIMk/c52b7VfxJO4M
SC7ElXHhgfN0pIdxn4xAmYI7O2YEG+F2RzDhSa6HNo+o3oJpv3c=
=Itzm
-----END PGP SIGNATURE-----
pgpwc1Q7LQElp.pgp
Description: PGP signature
--- End Message ---
