Hide Forgot
When connecting to gnome 3 desktop on RHEL 8.3, a password prompt is shown requiring authentication and showing the @subject message. Experiments made to attempt to remove the prompt were: o disable pscd service o Add: polkit.addRule(function(action, subject) { if (action.id == "org.debian.pcsc-lite.access_pcsc" && subject.isInGroup("{the-user-grop}")) { return polkit.Result.YES; } }); to /etc/polkit-1/rules.d/03-allow-pcscd.rules with and without {} around the group. o Changed the above to not check for subject.isInGroup to make sure there was no bug in the rule. o Several experiments in /usr/share/polkit-1/actions/org.debian.pcsc-lite.policy Like replacing all ocurrences of <allow_any>auth_admin</allow_any> with: <allow_any>auth_self</allow_any> o Also following the above, attempted changing <allow_any>auth_self</allow_any> <allow_inactive>auth_self</allow_inactive> <allow_active>yes</allow_active> to <allow_any>no</allow_any> <allow_inactive>no</allow_inactive> <allow_active>no</allow_active> o Last attempts were to check/verify $ gsettings get org.gnome.login-screen enable-smartcard-authentication that as expected returns 'false', and validate /etc/dconf/db/distro.d/20-authselect had the line 'enable-smartcard-authentication=false' in the section '[org/gnome/login-screen]' Neither of the above did help. Need some extra input of possible ways to debug and resolve the issue. RHEL8 server is accessed using Microsoft's Remote Desktop and MoboXterm.
pscs-lite does not have any UI prompts. I'm at a loss to understand why gnome3-desktop needs to authenticate to access it (I'm running rhel8, with pcsc-lite and a smart card reader installed and do not get thoses prompts). Reassigning to gnome3-desktop, which is probably wrong because it's probably coming from some other gnome3 application, but it's the best guess. It's almost certainly something going on with the reporter's setup. bob
I do not follow how changes to sshd_config can fix neither of the issues they were seeing. But given that they no longer see the issues, there is nothing to fix on our side.
@jjelen This is bug 1928154. It needs to be fixed in RHEL, just like it was in Fedora. Please re-open and update version to 8.5.
err, bug 1478345...
I will try plan it for next releases.
Looks good. But still, I think the link to the documentation should be there as it is relevant to the users who used the functionality to escalate privileges of non-privileged users. They will need to adjust the policy according to that guide.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (pcsc-lite bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:2089