Debian Templates: 'su -' asks for password

[adrelanos]

su - asks for password.

A user was confused by this:
https://groups.google.com/forum/#!topic/qubes-users/DQwXOrzwdWE

This is specifically confusing in Whonix, because there ~/.bashrc tells one, that the default password is changeme. (That text could be omitted.) Anyhow. This issue equally applies to the Debian templates.

Since Qubes allows passwordless sudo anyhow (See: https://github.com/QubesOS/qubes-core-agent-linux/blob/master/misc/qubes.sudoers)... I suggest making su - passwordless. Or does anything speak against that?

Does someone know how to configure /etc/pam.d or is this TODO research?

[nrgaway]

Can a user just not use sudo su?

Otherwise I will let @marmarek answer

[nrgaway]

Can a user just not use sudo su?

Otherwise I will let @marmarek answer

[adrelanos]

They can. But what causes confusion for one user, probably accustomed to non-Debian distributions, will cause confusion for another user. If we're lucky, this would be just one more file with one to three lines of code.

[adrelanos]

They can. But what causes confusion for one user, probably accustomed to non-Debian distributions, will cause confusion for another user. If we're lucky, this would be just one more file with one to three lines of code.

[unman]

Debian doesnt have wheel group, but you could create it, add user to it and then uncomment this line in pam.d/su:
auth sufficient pam_wheel.so trust

[unman]

Debian doesnt have wheel group, but you could create it, add user to it and then uncomment this line in pam.d/su:
auth sufficient pam_wheel.so trust

[adrelanos]

Do you think there can be a solution that doesn't require editing a file / adding a group? A bit simpler? Just a single drop-in /etc/pam.d/qubes?

[adrelanos]

Do you think there can be a solution that doesn't require editing a file / adding a group? A bit simpler? Just a single drop-in /etc/pam.d/qubes?

[unman]

I think you have to edit the pam.d/su file.
If you dont want to add a group you could add - auth sufficient pam_permit.so

[unman]

I think you have to edit the pam.d/su file.
If you dont want to add a group you could add - auth sufficient pam_permit.so

[adrelanos]

Nice.
Appending to /etc/pam.d/su:

auth sufficient pam_permit.so

Works for me.

[adrelanos]

Nice.
Appending to /etc/pam.d/su:

auth sufficient pam_permit.so

Works for me.

[adrelanos]

If this is fine to implement, I could provide a pull request. Using https://packages.debian.org/jessie/config-package-dev. A clean way to create diversions / config packages. That way the Qubes specific file would not cause an interactive dpkg conflict resolution dialog if upstream's /etc/pam.d/su gets updated.

[adrelanos]

If this is fine to implement, I could provide a pull request. Using https://packages.debian.org/jessie/config-package-dev. A clean way to create diversions / config packages. That way the Qubes specific file would not cause an interactive dpkg conflict resolution dialog if upstream's /etc/pam.d/su gets updated.

[marmarek]

On Fedora template we have simply empty root password (usermod -p '' root), which does the trick. Apparently it doesn't work on Debian,
because pam_unix have nullok_secure option instead of nullok.

Anyway I don't think it can be changed without modifying some file in
/etc/pam.d (either su - as above, or common-auth -
s/nullok_secure/nullok/), so config-package-dev is probably the way to
go.

Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?

[marmarek]

On Fedora template we have simply empty root password (usermod -p '' root), which does the trick. Apparently it doesn't work on Debian,
because pam_unix have nullok_secure option instead of nullok.

Anyway I don't think it can be changed without modifying some file in
/etc/pam.d (either su - as above, or common-auth -
s/nullok_secure/nullok/), so config-package-dev is probably the way to
go.

Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?

[adrelanos]

Done:
https://github.com/marmarek/qubes-core-agent-linux/pull/31

[adrelanos]

Done:
https://github.com/marmarek/qubes-core-agent-linux/pull/31