Package: libpam-mount
Version: 2.0-1
Severity: normal
Tags: sid
I have a LUKS encrypted /home partition with two keys.
Slot 0 is a longish phrase, slot 1 is the same as my login password.
Since a recent upgrade, /home isn't mounted automatically anymore
when I log in. Apparently, the underlying mount.crypt stopped
working with the slot 1 password, whereas it still works with the
slot 0 one.
This is the case when I try to switch the user (su) from root to
the single one that triggers mounting of /home, as well as when I
run mount.crypt explicitly.
Regarding the fskeyhash specified in /etc/security/pam_mount.conf.xml,
it makes no difference, whether I leave it out (produces a warning),
give it as "(null)" or "sha1".
Notably, cryptsetup luksOpen and subsequent mounting of the mapped
device, still works with the slot 1 password as well as the slot 0
one.
Michael
-- System Information:
Debian Release: squeeze/sid
APT prefers unstable
APT policy: (990, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 2.6.32-5-686 (SMP w/2 CPU cores)
Locale: LANG=POSIX, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages libpam-mount depends on:
ii libc6 2.10.2-6 Embedded GNU C Library: Shared lib
ii libcryptsetup1 2:1.1.0-2.1 libcryptsetup shared library
ii libhx22 3.4-1 A library providing queue, tree, I
ii libpam-runtime 1.1.1-3 Runtime support for the PAM librar
ii libpam0g 1.1.1-3 Pluggable Authentication Modules l
ii libssl0.9.8 0.9.8n-1 SSL shared libraries
ii libxml2 2.7.7.dfsg-2 GNOME XML library
ii mount 2.16.2-0 Tools for mounting and manipulatin
libpam-mount recommends no packages.
Versions of packages libpam-mount suggests:
ii davfs2 1.4.5-1 mount a WebDAV resource as a regul
ii fuse-utils 2.8.1-1.2 Filesystem in USErspace (utilities
ii lsof 4.81.dfsg.1-1 List open files
pn ncpfs <none> (no description available)
ii openssl 0.9.8n-1 Secure Socket Layer (SSL) binary a
ii psmisc 22.11-1 utilities that use the proc file s
ii smbfs 2:4.1-1 Common Internet File System utilit
ii sshfs 2.2-1 filesystem client based on SSH Fil
pn tc-utils <none> (no description available)
ii xfsprogs 3.1.1 Utilities for managing the XFS fil
-- Configuration Files:
/etc/security/pam_mount.conf.xml changed:
<?xml version="1.0" encoding="utf-8" ?>
<!DOCTYPE pam_mount SYSTEM "pam_mount.conf.xml.dtd">
<!--
See pam_mount.conf(5) for a description.
-->
<pam_mount>
<!-- Volume definitions -->
<!-- MS -->
<volume
user="michael"
fstype="crypt"
path="/dev/disk/by-uuid/90ccd500-0d23-417c-af6c-c5d3ca09f7da"
mountpoint="/home"
fskeyhash="sha1"
options="noatime"
/>
<!-- pam_mount parameters: General tunables -->
<debug enable="1" />
<!--
<luserconf name=".pam_mount.conf.xml" />
-->
<!-- Note that commenting out mntoptions will give you the defaults.
You will need to explicitly initialize it with the empty string
to reset the defaults to nothing. -->
<mntoptions
allow="nosuid,nodev,loop,encryption,fsck,nonempty,allow_root,allow_other" />
<!--
<mntoptions deny="suid,dev" />
<mntoptions allow="*" />
<mntoptions deny="*" />
-->
<mntoptions require="nosuid,nodev" />
<path>/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin</path>
<logout wait="0" hup="0" term="0" kill="0" />
<!-- pam_mount parameters: Volume-related -->
<mkmountpoint enable="1" remove="true" />
</pam_mount>
-- debconf information:
libpam-mount/convert-xml-config: false
# su michael
pam_mount(pam_mount.c:552): pam_mount 2.0: entering session stage
reenter password for pam_mount: <entered slot 1 password>
pam_mount(misc.c:38): Session open: (uid=0, euid=0, gid=1000, egid=1000)
pam_mount(mount.c:196): Mount info: globalconf, user=michael <volume
fstype="crypt" server="(null)"
path="/dev/disk/by-uuid/90ccd500-0d23-417c-af6c-c5d3ca09f7da"
mountpoint="/home" cipher="(null)" fskeypath="(null)" fskeycipher="(null)"
fskeyhash="sha1" options="noatime" /> fstab=0
command: 'mount.crypt' '-ofsk_hash=sha1' '-onoatime'
'/dev/disk/by-uuid/90ccd500-0d23-417c-af6c-c5d3ca09f7da' '/home'
pam_mount(misc.c:38): set_myuid<pre>: (uid=0, euid=0, gid=1000, egid=1000)
pam_mount(misc.c:38): set_myuid<post>: (uid=0, euid=0, gid=1000, egid=1000)
Filesystem Type 1K-blocks Used Available Use% Mounted on
/dev/sda1 ext3 964500 211772 703732 24% /
tmpfs tmpfs 1552796 8 1552788 1% /lib/init/rw
proc proc 0 0 0 - /proc
sysfs sysfs 0 0 0 - /sys
udev tmpfs 1547364 336 1547028 1% /dev
tmpfs tmpfs 1552796 0 1552796 0% /dev/shm
devpts devpts 0 0 0 - /dev/pts
tmpfs tmpfs 6291456 0 6291456 0% /tmp
/dev/sda5 ext4 67282996 43789648 20075524 69% /usr
fusectl fusectl 0 0 0 - /sys/fs/fuse/connections
binfmt_misc
binfmt_misc 0 0 0 - /proc/sys/fs/binfmt_misc
pam_mount(pam_mount.c:520): mount of
/dev/disk/by-uuid/90ccd500-0d23-417c-af6c-c5d3ca09f7da failed
command: 'pmvarrun' '-u' 'michael' '-o' '1'
pam_mount(misc.c:38): set_myuid<pre>: (uid=0, euid=0, gid=1000, egid=1000)
pam_mount(misc.c:38): set_myuid<post>: (uid=0, euid=0, gid=1000, egid=1000)
pmvarrun(pmvarrun.c:248): parsed count value 37
pam_mount(pam_mount.c:440): pmvarrun says login count is 38
pam_mount(pam_mount.c:642): done opening session (ret=0)
$ ls /home
$ exit
pam_mount(pam_mount.c:690): received order to close things
pam_mount(misc.c:38): Session close: (uid=1000, euid=1000, gid=1000, egid=1000)
command: 'pmvarrun' '-u' 'michael' '-o' '-1'
pam_mount(misc.c:38): set_myuid<pre>: (uid=1000, euid=1000, gid=1000, egid=1000)
pam_mount(spawn.c:101): error setting uid to 0
pam_mount(pam_mount.c:440): pmvarrun says login count is 37
pam_mount(pam_mount.c:719): michael seems to have other remaining open sessions
pam_mount(pam_mount.c:727): pam_mount execution complete
pam_mount(pam_mount.c:132): clean system authtok=0x96b8940 (0)
pam_mount(pam_mount.c:115): Clean global config (0)
# su michael
$ ls /dev/mapper
control _dev_sda6
# cryptsetup luksClose _dev_sda6
# ls /dev/mapper
# su michael
pam_mount(pam_mount.c:552): pam_mount 2.0: entering session stage
reenter password for pam_mount: <entered slot 0 password>
pam_mount(misc.c:38): Session open: (uid=0, euid=0, gid=1000, egid=1000)
pam_mount(mount.c:196): Mount info: globalconf, user=michael <volume
fstype="crypt" server="(null)"
path="/dev/disk/by-uuid/90ccd500-0d23-417c-af6c-c5d3ca09f7da"
mountpoint="/home" cipher="(null)" fskeypath="(null)" fskeycipher="(null)"
fskeyhash="sha1" options="noatime" /> fstab=0
command: 'mount.crypt' '-ofsk_hash=sha1' '-onoatime'
'/dev/disk/by-uuid/90ccd500-0d23-417c-af6c-c5d3ca09f7da' '/home'
pam_mount(misc.c:38): set_myuid<pre>: (uid=0, euid=0, gid=1000, egid=1000)
pam_mount(misc.c:38): set_myuid<post>: (uid=0, euid=0, gid=1000, egid=1000)
Filesystem Type 1K-blocks Used Available Use% Mounted on
/dev/sda1 ext3 964500 211772 703732 24% /
tmpfs tmpfs 1552796 8 1552788 1% /lib/init/rw
proc proc 0 0 0 - /proc
sysfs sysfs 0 0 0 - /sys
udev tmpfs 1547364 336 1547028 1% /dev
tmpfs tmpfs 1552796 0 1552796 0% /dev/shm
devpts devpts 0 0 0 - /dev/pts
tmpfs tmpfs 6291456 0 6291456 0% /tmp
/dev/sda5 ext4 67282996 43789660 20075512 69% /usr
fusectl fusectl 0 0 0 - /sys/fs/fuse/connections
binfmt_misc
binfmt_misc 0 0 0 - /proc/sys/fs/binfmt_misc
/dev/sda6 crypt 76968096 55834172 17224132 77% /home
command: 'pmvarrun' '-u' 'michael' '-o' '1'
pam_mount(misc.c:38): set_myuid<pre>: (uid=0, euid=0, gid=1000, egid=1000)
pam_mount(misc.c:38): set_myuid<post>: (uid=0, euid=0, gid=1000, egid=1000)
pmvarrun(pmvarrun.c:248): parsed count value 37
pam_mount(pam_mount.c:440): pmvarrun says login count is 38
pam_mount(pam_mount.c:642): done opening session (ret=0)
$ ls /home
lost+found michael
$ exit
pam_mount(pam_mount.c:690): received order to close things
pam_mount(misc.c:38): Session close: (uid=1000, euid=1000, gid=1000, egid=1000)
command: 'pmvarrun' '-u' 'michael' '-o' '-1'
pam_mount(misc.c:38): set_myuid<pre>: (uid=1000, euid=1000, gid=1000, egid=1000)
pam_mount(spawn.c:101): error setting uid to 0
pam_mount(pam_mount.c:440): pmvarrun says login count is 37
pam_mount(pam_mount.c:719): michael seems to have other remaining open sessions
pam_mount(pam_mount.c:727): pam_mount execution complete
pam_mount(pam_mount.c:132): clean system authtok=0x851f7a0 (0)
pam_mount(pam_mount.c:115): Clean global config (0)
