** Description changed:

+ SRU Justification:
+ 
+ [ Impact ]
+ 
+ Without these patches, Ubuntu users who have autologin enabled (or their
+ keyring locked via another method) will, upon entering the Remote
+ desktop / desktop sharing panel in gnome-control-center, have their
+ desktop sharing password silently reset to an autogenerated default,
+ preventing remote access.
+ 
+ [ Test Plan ]
+ 
+ 1. In gnome-control-center's "Users" panel, set your user to "Automatic 
Login" enabled
+ 2. systemctl soft-reboot (to save yourself some time compared to a full cold 
reboot)
+ 3. Notice that the keyring prompt does not necessarily appear immediately 
after login... and RDP won't work due to gnome-remote-desktop#27
+ 4. Locally, launch gnome-control-center
+ 5. Go to the "System > Remote Desktop" panel
+ 6. The gnome-keyring unlock prompt appears. Unlock it.
+ 
+ Expected results:
+ Wait for the keyring to unlock.
+ Never silently overwrite user-set passwords/passphrases, especially when the 
client-side remote desktop client might have saved a certain passphrase and is 
expecting it to not change. This is a form of data loss. 
+ 
+ Actual results:
+ If you click the eye icon button in the "Desktop Sharing" (and/or "Remote 
Login") password fields to "Show Password": you will see that the password has 
been automatically reset to a random passphrase, whatever you had previously 
set (and stored in the keyring) has been overwritten
+ 
+ [ Fix ]
+ 
+ If the keyring is locked, lock the username and password fields and show
+ a banner that explains that the keyring is locked, with an option to
+ unlock. Only handle the field population once the keyring has been
+ unlocked.
+ 
+ [ Where problems could occur ]
+ 
+ Users may not be accustomed to the unlock banner being present on this
+ page. Additionally, since the UI change had to be adjusted for Noble to
+ fit GNOME's older UI modeling format, it is possible that the UI
+ properties may not be 1:1 identical with the upstream patch. (however,
+ from a user perspective, it looks the same as the banner that was
+ already present on the "remote login" screen)
+ 
+ [ Other Info ]
+ 
  rdp cannot be used in a headless configuration as the saved rdp password
  is changed. If using manual login then the rdp password remains
  unchanged. This means that rdp cannot be used remotely.
  
  ProblemType: Bug
  DistroRelease: Ubuntu 22.10
  Package: gnome (not installed)
  ProcVersionSignature: Ubuntu 5.19.0-26.27-generic 5.19.7
  Uname: Linux 5.19.0-26-generic x86_64
  ApportVersion: 2.23.1-0ubuntu3
  Architecture: amd64
  CasperMD5CheckResult: pass
  CurrentDesktop: ubuntu:GNOME
  Date: Mon Dec 19 11:56:47 2022
  InstallationDate: Installed on 2022-12-15 (3 days ago)
  InstallationMedia: Ubuntu 22.04.1 LTS "Jammy Jellyfish" - Release amd64 
(20220809.1)
  SourcePackage: meta-gnome3
  UpgradeStatus: Upgraded to kinetic on 2022-12-18 (0 days ago)

** Description changed:

  SRU Justification:
  
  [ Impact ]
  
  Without these patches, Ubuntu users who have autologin enabled (or their
  keyring locked via another method) will, upon entering the Remote
  desktop / desktop sharing panel in gnome-control-center, have their
  desktop sharing password silently reset to an autogenerated default,
  preventing remote access.
  
  [ Test Plan ]
  
  1. In gnome-control-center's "Users" panel, set your user to "Automatic 
Login" enabled
  2. systemctl soft-reboot (to save yourself some time compared to a full cold 
reboot)
- 3. Notice that the keyring prompt does not necessarily appear immediately 
after login... and RDP won't work due to gnome-remote-desktop#27
+ 3. Notice that the keyring prompt does not necessarily appear immediately 
after login... and RDP won't work due to gnome-remote-desktop#27 
(https://gitlab.gnome.org/GNOME/gnome-remote-desktop/-/issues/27)
  4. Locally, launch gnome-control-center
  5. Go to the "System > Remote Desktop" panel
  6. The gnome-keyring unlock prompt appears. Unlock it.
  
  Expected results:
  Wait for the keyring to unlock.
- Never silently overwrite user-set passwords/passphrases, especially when the 
client-side remote desktop client might have saved a certain passphrase and is 
expecting it to not change. This is a form of data loss. 
+ Never silently overwrite user-set passwords/passphrases, especially when the 
client-side remote desktop client might have saved a certain passphrase and is 
expecting it to not change. This is a form of data loss.
  
  Actual results:
  If you click the eye icon button in the "Desktop Sharing" (and/or "Remote 
Login") password fields to "Show Password": you will see that the password has 
been automatically reset to a random passphrase, whatever you had previously 
set (and stored in the keyring) has been overwritten
  
  [ Fix ]
  
  If the keyring is locked, lock the username and password fields and show
  a banner that explains that the keyring is locked, with an option to
  unlock. Only handle the field population once the keyring has been
  unlocked.
  
  [ Where problems could occur ]
  
  Users may not be accustomed to the unlock banner being present on this
  page. Additionally, since the UI change had to be adjusted for Noble to
  fit GNOME's older UI modeling format, it is possible that the UI
  properties may not be 1:1 identical with the upstream patch. (however,
  from a user perspective, it looks the same as the banner that was
  already present on the "remote login" screen)
  
  [ Other Info ]
  
  rdp cannot be used in a headless configuration as the saved rdp password
  is changed. If using manual login then the rdp password remains
  unchanged. This means that rdp cannot be used remotely.
  
  ProblemType: Bug
  DistroRelease: Ubuntu 22.10
  Package: gnome (not installed)
  ProcVersionSignature: Ubuntu 5.19.0-26.27-generic 5.19.7
  Uname: Linux 5.19.0-26-generic x86_64
  ApportVersion: 2.23.1-0ubuntu3
  Architecture: amd64
  CasperMD5CheckResult: pass
  CurrentDesktop: ubuntu:GNOME
  Date: Mon Dec 19 11:56:47 2022
  InstallationDate: Installed on 2022-12-15 (3 days ago)
  InstallationMedia: Ubuntu 22.04.1 LTS "Jammy Jellyfish" - Release amd64 
(20220809.1)
  SourcePackage: meta-gnome3
  UpgradeStatus: Upgraded to kinetic on 2022-12-18 (0 days ago)

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2000063

Title:
  RDP password is silently reset to a random passphrase if using
  autologin

To manage notifications about this bug go to:
https://bugs.launchpad.net/gnome-control-center/+bug/2000063/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to