Red Hat Bugzilla – Bug 1260875
Cannot log in as root after install of recent Fedora 23 images
Last modified: 2015-09-16 14:36:03 EDT
In the 2015-09-07 nightly Fedora 23 images, and also 23 Beta TC4, after fresh install of the system you cannot log in as root. This is not an SELinux issue, at least not obviously: it still occurs if you boot with 'enforcing=0' or 'selinux=0'.
You can log in as a regular user created during install, but you cannot 'su' to root from that user account.
This is pretty mysterious for now, I'm going to look into it more tomorrow. Really not sure what's going wrong. There's no screamingly obvious smoking gun in the 2015-09-07 changes, but this definitely seems to have started breaking in the 2015-09-07 tests in openQA (2015-09-06 tests passed).
One thing I see is these messages in the logs after trying to su:
pam_unix(su:auth): authentication failure; logname=test uid=1000 euid=0 tty=tty1 ruser=test rhost= user=root
pam_succeed_if(su:auth): requirement "uid >= 1000" not met by user "root"
Component is kind of a guess for now.
Proposing as a Beta blocker. Not being able to access root has an impact on various criteria, let's say "The default system init daemon (e.g. systemd) must be capable of starting, stopping, enabling and disabling correctly-defined services." - can't do that without root. https://fedoraproject.org/wiki/Fedora_23_Alpha_Release_Criteria#System_service_manipulation
I just tested it with the workstation live cd:
using the live medium works fine, but installing on hdd is broken as Adam has described.
I booted into the VM with the live cd and mounted the "real" hdd.
A look into /etc/shadow showed an asterisk ("*") instead of a password-hash for root.
I was able to set the passwd from commandline after chrooting into the installed system.
After a reboot login as root works as expected.
I don't know, if this might be related or not: this was with a weak password where I have to click continue twice (in the installer).
It seems like some trivial anaconda/setup problem with /etc/shadow initialization.
+1 beta blocker.
I reproduced this on the Server Beta TC4 media just now. I entered a complex password for root in Anaconda (so no double-click to continue).
My guess is that this is fallout from the password-policy changes, but I can't confirm that yet.
Created attachment 1071402 [details]
Created attachment 1071403 [details]
Created attachment 1071404 [details]
Created attachment 1071405 [details]
Created attachment 1071406 [details]
*** Bug 1260415 has been marked as a duplicate of this bug. ***
sgallagh and I think we have a diagnosis and a fix now, just testing it.
https://www.happyassassin.net/updates/1260875.0.img is an updates.img with the proposed fix for this, if anyone else wants to test.
*** Bug 1261803 has been marked as a duplicate of this bug. ***
Discussed at 2015-09-10 blocker review meeting: https://meetbot-raw.fedoraproject.org/fedora-blocker-review/2015-09-10/f23-blocker-review.2015-09-10-16.00.log.txt . Accepted as a beta per criterion "It must be possible to log in to the default Cockpit instance" (with a typical install, the only user who's allowed to login to cockpit is root, so we went with that criterion).
python-blivet-1.12.3-1.fc23 anaconda-23.19.3-1.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-15562
anaconda-23.19.3-1.fc23, python-blivet-1.12.3-1.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update anaconda python-blivet'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-15562
*** Bug 1262361 has been marked as a duplicate of this bug. ***
python-blivet-1.12.4-1.fc23 anaconda-23.19.4-1.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2015-15846
anaconda-23.19.4-1.fc23, python-blivet-1.12.4-1.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.\nIf you want to test the update, you can install it with \n su -c 'yum --enablerepo=updates-testing update anaconda python-blivet'. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2015-15846
Verified in openQA testing.
anaconda-23.19.4-1.fc23, python-blivet-1.12.4-1.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.