Authentication failure at "Changing shell for x"

[ghost]

Authentication failure when running both the wget and curl installers. It occurs both when I'm using su -c and sudo in latest Fedora, as well as when I'm running without root privileges.

[apjanke]

I'm having trouble reproducing. The installer is working fine for me on Fedora 21 as a normal user or as root. (Though I wouldn't recommend setting up oh-my-zsh for root.)

You shouldn't need su -c or sudo, since oh-my-zsh is a per-user installation and installs in to your home directory. It does not require root privileges to install.

Is this still happening for you? Which version of Fedora are you running?

[apjanke]

Okay, I can reproduce a similar error now. Does this look like the error you were seeing?

Here's what I see on Debian 7, as a newly created user whose current default shell is /bin/bash.

alice@debbie:~$ curl -L https://raw.github.com/robbyrussell/oh-my-zsh/master/tools/install.sh | sh
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
100  1930  100  1930    0     0   5369      0 --:--:-- --:--:-- --:--:--  5369
Cloning Oh My Zsh...
Cloning into '/home/alice/.oh-my-zsh'...
remote: Counting objects: 636, done.
remote: Compressing objects: 100% (500/500), done.
remote: Total 636 (delta 14), reused 501 (delta 4), pack-reused 0
Receiving objects: 100% (636/636), 358.32 KiB, done.
Resolving deltas: 100% (14/14), done.
Looking for an existing zsh config...
Using the Oh My Zsh template file and adding it to ~/.zshrc
Copying your current PATH and adding it to the end of ~/.zshrc for you.
Time to change your default shell to zsh!
Password: chsh: PAM: Authentication failure
alice@debbie:~$ 

(I see basically the same thing on Fedora 21, too, with a fresh user account. I think the reason I couldn't reproduce before is that my user's shell was already zsh so the installer wasn't calling chsh.)

I'm guessing this is happening because the subshell that the installation script is running in is non-interactive, so chsh isn't prompting for a password (or it's prompting and reading an empty string instead of giving me a chance to type anything). I can reproduce that by just running chsh in a sh subshell.

alice@debbie:~$ echo "chsh -s /bin/zsh" | sh
Password: chsh: PAM: Authentication failure
alice@debbie:~$ chsh -s /bin/zsh
Password: 
alice@debbie:~$

I don't know how to fix this.

[apjanke]

Looks like this is related to, if not the same thing, as #1224.

[apjanke]

Okay, think I found the issue. As diagnosed in this AskUbuntu question, the problem is that the curl ... | sh invocation form is hooking up the output of curl the the stdin of the shell running the installation. So when chsh prompts for a password, it reads from stdin, which is the install.sh file we've downloaded, and not your keyboard. So it gets the wrong password, and fails.

I'm surprised this is happening for you as root. When I'm root, chsh does not prompt for a password, and the oh-my-zsh installer works fine.

Here's a workaround. Save the install.sh script to a temporary file and run it from there, instead of piping directly to sh like the normal installation command does. This will leave stdin open for chsh to read your password.

curl -L https://raw.github.com/robbyrussell/oh-my-zsh/master/tools/install.sh > install.sh && sh install.sh

This form works smoothly for me: it runs, lets me type in my password for chsh, and completes successfully.

[apjanke]

So, @robbyrussell and @mcornella, should we change the curl .../install.sh | sh command we're posting for the installation? Or add an alternate form for Linux systems? It looks like the current form will break on any system where chsh prompts for a password and the user's default shell is not already zsh.

[apjanke]

Better workaround: use backticks or subshell output capturing instead of a pipe or temp file.

sh -c "$(curl -fsSL https://raw.github.com/robbyrussell/oh-my-zsh/master/tools/install.sh)"

The double quotes are required in order to preserve line feeds and keep the script syntax correct.

[drawcard]

Better workaround: use backticks or subshell output capturing instead of a pipe or temp file.

sh -c "$(curl -fsSL https://raw.github.com/robbyrussell/oh-my-zsh/master/tools/install.sh)"

The double quotes are required in order to preserve line feeds and keep the script syntax correct.

Works great for me now :) (Running on a Ubuntu Trusty Vanilla VM + Vagrant)

[thekondr]

Hi guys,

chsh -s `which zsh` < /dev/tty

did the trick for me even for

curl ... | sh

[apjanke]

Interesting. This is turning in to an educational experience for me.

Seems to me it would be better to change the invocation method to sh -c "$(...)" instead of hardwiring the redirection internally with < /dev/tty. That way, if more interactive steps ever got added to the installation script, they would work without additional redirection. And philosophically, since install.sh is intended to be used interactively, it seems appropriate to leave its stdin hooked up to the normal stdin instead of the script source. That would also allow scripting of its interactive inputs in some cases, which could be used for unattended installations or automation of testing.