Bugzilla – Bug 1224261
cockpit: Refused user root for service cockpit
Last modified: 2024-05-16 07:46:12 UTC
On a fresh Leap 15.6 installation I cannot login to cockpit as root user. The WebUI throws the error: "Wrong user name or password" In the journal I see the following error messages > May 15 10:41:40 radroach cockpit-session[15173]: pam_listfile(cockpit:auth): Refused user root for service cockpit > May 15 10:41:57 radroach cockpit-session[15175]: pam_listfile(cockpit:auth): Refused user root for service cockpit > May 15 10:42:08 radroach cockpit-session[15178]: pam_listfile(cockpit:auth): Refused user root for service cockpit I'm using the default settings, including AppArmor. YaST didn't show anything in the audit logs.
It's the default confiugration Felix See also https://github.com/cockpit-project/cockpit/issues/18427 lkocman@localhost:~/Workspace/opensuse/os-autoinst-distri-opensuse> cat /etc/cockpit/disallowed-users # List of users which are not allowed to login to Cockpit root lkocman@localhost:~/Workspace/opensuse/os-autoinst-distri-opensuse> grep PRETTY_NAME /etc/os-release; PRETTY_NAME="openSUSE Leap 15.6" lkocman@localhost:~/Workspace/opensuse/os-autoinst-distri-opensuse>
I suppose we want similar experience as on LeapMicro. Otherwise, this would be an issue on Factory as well. lkocman@localhost:~/Workspace/opensuse/os-autoinst-distri-opensuse> rpm -qf /etc/cockpit/disallowed-users cockpit-ws-309-bp156.1.4.x86_64
Seems like anything else than rhel <8 has it disabled in spec. I suppose micro does some magic outside of the spec. # Allow root login in Cockpit on RHEL 8 and lower as it also allows password login over SSH. %if 0%{?rhel} && 0%{?rhel} <= 8 %define disallow_root 0 %else %define disallow_root 1 %endif
Ah, it seems also on Factory this is the now the default behavior. I was not aware that this changed, but it looks like this is expected. I think we can close this bug as invalid then.
Wait a sec Felix I'm thinking of /etc/motd update which happens for cockpit We could also mention this on ReleaseNotes/wiki. I think there is a value in having info somewhere.
Fully agree.