Can not login by default root user on Debian11

[GOKORURI007]

Explain what happens

1. I followed the instruction in official site to installed cockpit on my debian11 mechine, which have a default user called "root".
2. After installation, I run the follow command to start the cockpit server and try to login

systemctl enable cockpit --now
systemctl enable cockpit.socket --now

3. Unfortunately, every time I try to login with the user "root", the website show the username or password error. But I can login to the panel by my fresh created user called "xxx".
   
4. More over, after I login to the panel, I can see the user "root" in the Account Tab of the panel. And the last active of "root" is indeed to login.
   

Version of Cockpit

285-1~bpo11+1

Where is the problem in Cockpit?

Accounts

Server operating system

Debian

Server operating system version

Debian11 Bullseye

What browsers are you using?

Chrome

System log

-- Journal begins at Thu 2021-08-19 14:46:25 EDT, ends at Tue 2023-02-28 12:39:42 EST. --
Feb 28 12:38:48 racknerd-f64dc7 sshd[29432]: Received disconnect from 104.248.197.238 port 36140:11: Bye Bye [preauth]
Feb 28 12:38:48 racknerd-f64dc7 sshd[29432]: Disconnected from authenticating user root 104.248.197.238 port 36140 [preauth]
Feb 28 12:39:02 racknerd-f64dc7 sshd[29434]: Invalid user webmaster from 119.165.216.55 port 44612
Feb 28 12:39:02 racknerd-f64dc7 sshd[29434]: pam_unix(sshd:auth): check pass; user unknown
Feb 28 12:39:02 racknerd-f64dc7 sshd[29434]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.165.216.55
Feb 28 12:39:04 racknerd-f64dc7 sshd[29434]: Failed password for invalid user webmaster from 119.165.216.55 port 44612 ssh2
Feb 28 12:39:05 racknerd-f64dc7 sshd[29434]: Received disconnect from 119.165.216.55 port 44612:11: Bye Bye [preauth]
Feb 28 12:39:05 racknerd-f64dc7 sshd[29434]: Disconnected from invalid user webmaster 119.165.216.55 port 44612 [preauth]
Feb 28 12:39:12 racknerd-f64dc7 polkitd(authority=local)[23299]: Unregistered Authentication Agent for unix-session:10 (system bus name :1.62, object path /org/freedesktop/PolicyKit1/Authe>
Feb 28 12:39:12 racknerd-f64dc7 cockpit-session[29333]: pam_unix(cockpit:session): session closed for user yjc
Feb 28 12:39:12 racknerd-f64dc7 systemd[1]: session-10.scope: Succeeded.
Feb 28 12:39:12 racknerd-f64dc7 systemd-logind[521]: Session 10 logged out. Waiting for processes to exit.
Feb 28 12:39:12 racknerd-f64dc7 systemd-logind[521]: Removed session 10.
Feb 28 12:39:13 racknerd-f64dc7 cockpit-tls[28584]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Feb 28 12:39:13 racknerd-f64dc7 cockpit-tls[28584]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Feb 28 12:39:14 racknerd-f64dc7 cockpit-tls[28584]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Feb 28 12:39:14 racknerd-f64dc7 cockpit-tls[28584]: cockpit-tls: gnutls_handshake failed: A TLS fatal alert has been received.
Feb 28 12:39:21 racknerd-f64dc7 cockpit-session[29444]: pam_listfile(cockpit:auth): Refused user root for service cockpit
Feb 28 12:39:22 racknerd-f64dc7 systemd[1]: Stopping User Manager for UID 1000...
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: Stopped target Main User Target.
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: Stopping D-Bus User Message Bus...
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: dbus.service: Succeeded.
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: Stopped D-Bus User Message Bus.
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: Stopped target Basic System.
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: Stopped target Paths.
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: Stopped target Sockets.
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: Stopped target Timers.
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: dbus.socket: Succeeded.
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: Closed D-Bus User Message Bus Socket.
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: dirmngr.socket: Succeeded.
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: Closed GnuPG network certificate management daemon.
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: gpg-agent-browser.socket: Succeeded.
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: Closed GnuPG cryptographic agent and passphrase cache (access for web browsers).
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: gpg-agent-extra.socket: Succeeded.
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: Closed GnuPG cryptographic agent and passphrase cache (restricted).
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: gpg-agent-ssh.socket: Succeeded.
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: Closed GnuPG cryptographic agent (ssh-agent emulation).
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: gpg-agent.socket: Succeeded.
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: Closed GnuPG cryptographic agent and passphrase cache.
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: pk-debconf-helper.socket: Succeeded.
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: Closed debconf communication socket.
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: Removed slice User Application Slice.
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: Reached target Shutdown.
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: systemd-exit.service: Succeeded.
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: Finished Exit the Session.
Feb 28 12:39:22 racknerd-f64dc7 systemd[29340]: Reached target Exit the Session.
Feb 28 12:39:22 racknerd-f64dc7 systemd[1]: user@1000.service: Succeeded.
Feb 28 12:39:22 racknerd-f64dc7 systemd[1]: Stopped User Manager for UID 1000.
Feb 28 12:39:22 racknerd-f64dc7 systemd[1]: Stopping User Runtime Directory /run/user/1000...
Feb 28 12:39:23 racknerd-f64dc7 systemd[19689]: run-user-1000.mount: Succeeded.
Feb 28 12:39:23 racknerd-f64dc7 systemd[1]: run-user-1000.mount: Succeeded.
Feb 28 12:39:23 racknerd-f64dc7 systemd[1]: user-runtime-dir@1000.service: Succeeded.
Feb 28 12:39:23 racknerd-f64dc7 systemd[1]: Stopped User Runtime Directory /run/user/1000.
Feb 28 12:39:23 racknerd-f64dc7 systemd[1]: Removed slice User Slice of UID 1000.
Feb 28 12:39:31 racknerd-f64dc7 cockpit-session[29446]: pam_listfile(cockpit:auth): Refused user root for service cockpit
Feb 28 12:39:34 racknerd-f64dc7 sshd[29447]: Invalid user one from 119.165.216.55 port 44044
Feb 28 12:39:34 racknerd-f64dc7 sshd[29447]: pam_unix(sshd:auth): check pass; user unknown
Feb 28 12:39:34 racknerd-f64dc7 sshd[29447]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=119.165.216.55
Feb 28 12:39:36 racknerd-f64dc7 sshd[29447]: Failed password for invalid user one from 119.165.216.55 port 44044 ssh2
Feb 28 12:39:37 racknerd-f64dc7 sshd[29447]: Received disconnect from 119.165.216.55 port 44044:11: Bye Bye [preauth]
Feb 28 12:39:37 racknerd-f64dc7 sshd[29447]: Disconnected from invalid user one 119.165.216.55 port 44044 [preauth]
Feb 28 12:39:42 racknerd-f64dc7 systemd[1]: systemd-timedated.service: Succeeded.

[jelly]

Root login is now by default disabled by /etc/cockpit/disallowed-users, so if you want to allow root login you will need to remove the root entry from that file.

[GOKORURI007]

Thank you for your kindly surport!

[martinpitt]

@JohnnyHom We do not tolerate such unfounded attacks and rants here. I reported you to GitHub.

[dotbanana]

Now in Debian 12 after fresh (remote) install i experience the same.
Not only is root-login not possible, it is no login possible with neither user on the system.
I removed the line in disallowed-users and rebooted, but that does not help.
It might also be something with the tunneling, i have tried to setup a socksproxy through ssh with -D 9000, and then going with browser not working. Tunnel with -L 9090 not working.
Always bad username and password.
Other tunnelings to other software works always fine without problems.
But on the other hand I would expect that with a piece of software of that kind, administration of server, i would think that most people use it through tunnel so that shouldn't be the problem i suppose.
Removed the package from system. I was eager to at least see something more of this tool than login screen. :(

[martinpitt]

@dotbanana Please check the journal during login, it should have some error messages. Indeed forwarding the cockpit port is not a problem, we do this all the time. It's not what we recommend for production setups, but it does/should work.