OK, I figured it out.

On Mon November 5 2007 06:00, Carlos E. R. wrote:
> The Monday 2007-11-05 at 02:24 -0600, Carlos F Lange wrote:
> >> I can't fire up Yast from kde, using kdesu I presume. I can "su"
> >> to root on any console or xterm, and using gnome - but not kdesu
> >> in kde.
> >
> > It seems to be just kdesu. Kwallet for root also requires the
> > password in a separate window and it is working fine.
>
> I got an off-list reply suggesting to try typing our user's password
> instead of root's - it worked for him once in 10.2, he says.

Yes, the user psasword works.

> I can't try that at the moment, as I'm right now running gnome.
>
> >> I can't say since when, as I updated to 10.3 last Saturday.
> >
> > It must be in last few days. I didn't use my laptop wit 10.3 for a
> > couple of days and when I ran it on Saturday the problem was there.
>
> And you updated something? In my case, everything was updated on
> Saturday, so I don't know how it behaved previously. I think the RC3
> didn't have this problem, though, but it's not the first time it
> happens.

I was able to trace it back to a change in sudoers.
I found through these bug reports:
https://bugzilla.novell.com/show_bug.cgi?id=216796
https://bugzilla.novell.com/show_bug.cgi?id=336204
that kdesu now uses sudo to interpret passwords and that is why, if you 
don't change the default in /etc/sudoers to "timestamp_timeout = 0", 
you can fire-up Yast2 without typing a password within 5 minutes of 
entering the password once.

In my case I changed sudoers to give myself full administrator control 
with sudo (and to time out immediately) and to ask for the user 
password instead of the root password ("Defaults:ADMIN_USERS 
authenticate", while previously defining the ADMIN_USERS list)
and from that moment on, kdesu started accepting only my user password.

Since I moved from 10.1 to 10.3, this behaviour is new to me, but upon 
reflection it makes sense. If I give a user full administrator access 
in the command line with sudo and user password, the user should be 
able to start anything with kdesu and user password. In 10.1, such a 
user could only start the ncurses version of Yast and I always wondered 
why.

What I find not OK is that these settings disable the root password in 
kdesu. While I could always start YaST2 using my user password, I just 
created a test user that is only allowed in sudoers to install printers 
and run openvpn, and that user cannot start YaST2 with kdesu, not even 
with root password! I will file a bug report on this particular 
behaviour.

In addition, I agree with comments 6 and 7:
https://bugzilla.novell.com/show_bug.cgi?id=216796#c6
that this behaviour of kdesu should be well documented and highlighted, 
specially the time-out thing.

-- 
Carlos FL

Who is General Failure, and why is he reading my disk?
-- 
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Reply via email to