Hi,

I'm installing the default server configuration. The user ('user1234', password
'secret_1234') does not get created in the installer. According to the Wiki
[1], this is a very important user. See the automated results in openQA [2].
The openQA setup uses ('testy', 'weakpassword')

Before the installer reboots, I've opened a shell to do some diagnostics.

`/usr/bin/user-setup-apply /target` is called to set up the users.

The root user was been created correctly.

In /target: there is no reference to the user in /target/etc/group,
/target/etc/passwd, /target/home.

I've enabled some debugging in user-setup-apply (set -x) to look that the
issue.

`db_get passwd/make_user` returns 'boolean false' instead of 'true', which is
suspect

I then forced some variables, to try to force the creation of the user:
```
db_set passwd/make-user 'true'
db_set passwd/username 'user1234'
db_set passwd/user-password 'secret_1234'
db_set passwd/user-password-again 'secret_1234'
db_set passwd/user-fullname 'Test user'
```

Side-note: the function 'is_system_user' really checks whether a non-system
user account exists (i.e. a UID in the range 1000-59999 in /target/etc/passwd)

After re-running `user-setup-apply /target`, the user is created without a
password and has a home directory. However upon the attempt to set the
password:
```
+ setpassword test1234 secret_1234 false
...
+ chroot /target chpasswd
chpasswd: (user test1234) pam_chauthok() failed, error:
Authentication token manipulation error
chpasswd: (line 1, user test1234) password not changed
```

`echo "root:newpwd" | chpasswd` works.

I looked a bit at the strace output, the first entry for /dev/log mentions
'pam_edu_nopw', whereas for test1234 it has 'chpasswd'.

With kind regards,
Roland Clobus

[1] https://wiki.debian.org/DebianEdu/Documentation/Trixie/Installation
[2] https://openqa.debian.net/tests/563978

Hi Roland,

While the observation is correct, there is a misunderstanding of the
concept of a Debian Edu main server installation.

The classical POSIX user that D-I creates normally is not created on
Debian Edu system (except from the standalong workstation installation).

The initial user is created only for TJENER, but not in /etc/passwd &
friends but in LDAP.

So, if you run getent passwd on a rebootet main server, you should
find that initial user.

Please see
https://salsa.debian.org/debian-edu/debian-edu-config/-/blob/master/ldap-tools/ldap-debian-edu-install?ref_type=heads to read the full post-package-install story happening at the end of a Debian Edu mainserver D-I installation
run.

I guess, this bug can be closed then? (If so, please do. Otherwise,
provide more feedback / thoughts).

Mike

Control: retitle -1 debian-edu-config: 13.6.0: user not created

I've run the scenario on openQA using the published edu netinst images, so the installer log files are publicly available for review.

I ran the the installer on several edu netinst images:
* the 12.15.0 bookworm edu netinst: the login works fine [1]
* the 13.6.0 trixie edu netinst: the user cannot log in [2] (note that the icinga installation will be skipped [3])
* the daily image from 2026-08-031 (forky) (because after that, #1146491 and kernel updates happened): the login works fine [4] (the icinga issue is no longer present in forky)

Could it be that the LDAP configuration is partly done by the icinga module and some of it is an implicit requirement for the ldap-debian-edu-install script?

With kind regards,
Roland

[1] https://openqa.debian.net/tests/566651#step/_graphical_wait_login/14
[2] https://openqa.debian.net/tests/566649#step/_graphical_wait_login/23
[3] https://openqa.debian.net/tests/566649#step/grub/91
[4] https://openqa.debian.net/tests/571206
--- From the 12.15.0 installation log
Aug 27 19:13:04 cf-agent[2977]: CFEngine(agent)  Executing 'no timeout' ... '/usr/bin/ldap-debian-edu-install'
Aug 27 19:13:07 slapd[6717]: @(#) $OpenLDAP: slapd 2.5.13+dfsg-5 (Feb  8 2023 01:56:12) $ 	Debian OpenLDAP Maintainers <pkg-openldap-devel@lists.alioth.debian.org>
Aug 27 19:13:07 slapd[6718]: slapd starting
Aug 27 19:13:08 kadmin.local[6746]: No dictionary file specified, continuing without one.
Aug 27 19:13:08 kadmin.local[6747]: No dictionary file specified, continuing without one.
Aug 27 19:13:08 kadmin.local[6749]: No dictionary file specified, continuing without one.
Aug 27 19:13:08 kadmin.local[6750]: No dictionary file specified, continuing without one.
Aug 27 19:13:08 slapd[6718]: connection_read(19): no connection!
Aug 27 19:13:08 kadmin.local[6751]: No dictionary file specified, continuing without one.
Aug 27 19:13:08 kadmin.local[6752]: No dictionary file specified, continuing without one.
Aug 27 19:13:08 kadmin.local[6753]: No dictionary file specified, continuing without one.
Aug 27 19:13:08 kadmin.local[6754]: No dictionary file specified, continuing without one.
Aug 27 19:13:08 cf-agent[2977]: CFEngine(agent)  Q: "...du-install": info: Creating first user <testy> 'Testy McTestface'. Q: "...du-install": To initialize a brand new LDAP+KDC:  Q: "...du-install": rm /var/lib/ldap/__db* /var/lib/ldap/*.bdb Q: "...du-install": rm /etc/krb5kdc/stash /etc/krb5.keytab* Q: "...du-install": LDAP passwords cleared from debconf database. Q: "...du-install": The provided LDAP password is valid. Q: "...du-install": info: added '/etc/ldap/root.ldif' to ldap database. Q: "...du-install": info: added '/etc/ldap/ipnetworks.ldif' to ldap database. Q: "...du-install": info: added '/etc/ldap/netgroup.ldif' to ldap database. Q: "...du-install": info: added '/etc/ldap/autofs.ldif' to ldap database. Q: "...du-install": info: added '/etc/ldap/sudo.ldif' to ldap database. Q: "...du-install": info: added '/etc/ldap/gosa.ldif' to ldap database. Q: "...du-install": info: added '/etc/ldap/gosa-server.ldif' to ldap database. Q: "...du-install": info: added '/etc/ldap/ltsp.ldif' to ldap database
Aug 27 19:13:08 kadmin.local[6755]: No dictionary file specified, continuing without one.
Aug 27 19:13:08 kadmin.local[6756]: No dictionary file specified, continuing without one.
Aug 27 19:13:08 kadmin.local[6758]: No dictionary file specified, continuing without one.
Aug 27 19:13:08 kadmin.local[6759]: No dictionary file specified, continuing without one.
Aug 27 19:13:08 kadmin.local[6761]: No dictionary file specified, continuing without one.
Aug 27 19:13:08 kadmin.local[6762]: No dictionary file specified, continuing without one.
Aug 27 19:13:08 kadmin.local[6764]: No dictionary file specified, continuing without one.
Aug 27 19:13:08 kadmin.local[6765]: No dictionary file specified, continuing without one.
Aug 27 19:13:08 kadmin.local[6774]: No dictionary file specified, continuing without one.
Aug 27 19:13:09 cf-agent[2977]: CFEngine(agent)  Q: "...du-install": Entry for principal cifs/tjener.intern with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab. Q: "...du-install": No policy specified for ldap/tjener.intern@INTERN; defaulting to no policy Q: "...du-install": Authenticating as principal root/admin@INTERN with password. Q: "...du-install": Principal "ldap/tjener.intern@INTERN" created. Q: "...du-install": Authenticating as principal root/admin@INTERN with password. Q: "...du-install": Entry for principal ldap/tjener.intern with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab WRFILE:/etc/krb5.keytab.ldap. Q: "...du-install": Entry for principal ldap/tjener.intern with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab WRFILE:/etc/krb5.keytab.ldap. Q: "...du-install": No policy specified for imap/tjener.intern@INTERN; defaulting to no policy Q: "...du-install": Authenticating as principal root/admin@INTERN with password. Q:
Aug 27 19:13:09 cf-agent[2977]: CFEngine(agent)  Last 76 quoted lines were generated by promiser '/usr/bin/ldap-debian-edu-install'
Aug 27 19:13:09 cf-agent[2977]: CFEngine(agent)  Completed execution of '/usr/bin/ldap-debian-edu-install'
---

--- From the 13.6.0 installation log
Aug 27 18:58:19 cf-agent[15511]: CFEngine(agent)  Executing 'no timeout' ... '/usr/bin/ldap-debian-edu-install'
Aug 27 18:58:22 slapd[17927]: @(#) $OpenLDAP: slapd 2.6.10+dfsg-1 (May 29 2025 23:41:48) $ 	Debian OpenLDAP Maintainers <pkg-openldap-devel@lists.alioth.debian.org>
Aug 27 18:58:22 slapd[17928]: slapd starting
Aug 27 18:58:23 kadmin.local[17955]: No dictionary file specified, continuing without one.
Aug 27 18:58:23 kadmin.local[17956]: No dictionary file specified, continuing without one.
Aug 27 18:58:23 kadmin.local[17957]: No dictionary file specified, continuing without one.
Aug 27 18:58:23 kadmin.local[17958]: No dictionary file specified, continuing without one.
Aug 27 18:58:23 kadmin.local[17959]: No dictionary file specified, continuing without one.
Aug 27 18:58:23 kadmin.local[17960]: No dictionary file specified, continuing without one.
Aug 27 18:58:23 kadmin.local[17961]: No dictionary file specified, continuing without one.
Aug 27 18:58:23 kadmin.local[17962]: No dictionary file specified, continuing without one.
Aug 27 18:58:23 cf-agent[15511]: CFEngine(agent)  Q: "...du-install": info: Creating first user <testy> 'Testy McTestface'. Q: "...du-install": To initialize a brand new LDAP+KDC:  Q: "...du-install": rm /var/lib/ldap/__db* /var/lib/ldap/*.bdb Q: "...du-install": rm /etc/krb5kdc/stash /etc/krb5.keytab* Q: "...du-install": LDAP passwords cleared from debconf database. Q: "...du-install": The provided LDAP password is valid. Q: "...du-install": info: added '/etc/ldap/root.ldif' to ldap database. Q: "...du-install": info: added '/etc/ldap/ipnetworks.ldif' to ldap database. Q: "...du-install": info: added '/etc/ldap/netgroup.ldif' to ldap database. Q: "...du-install": info: added '/etc/ldap/autofs.ldif' to ldap database. Q: "...du-install": info: added '/etc/ldap/sudo.ldif' to ldap database. Q: "...du-install": info: added '/etc/ldap/gosa.ldif' to ldap database. Q: "...du-install": info: added '/etc/ldap/gosa-server.ldif' to ldap database. Q: "...du-install": info: added '/etc/ldap/ltsp.ldif' to ldap databas
Aug 27 18:58:23 kadmin.local[17963]: No dictionary file specified, continuing without one.
Aug 27 18:58:23 kadmin.local[17964]: No dictionary file specified, continuing without one.
Aug 27 18:58:23 kadmin.local[17966]: No dictionary file specified, continuing without one.
Aug 27 18:58:23 kadmin.local[17967]: No dictionary file specified, continuing without one.
Aug 27 18:58:23 kadmin.local[17969]: No dictionary file specified, continuing without one.
Aug 27 18:58:23 kadmin.local[17970]: No dictionary file specified, continuing without one.
Aug 27 18:58:23 slapd[17928]: connection_read(17): no connection!
Aug 27 18:58:23 kadmin.local[17972]: No dictionary file specified, continuing without one.
Aug 27 18:58:23 kadmin.local[17973]: No dictionary file specified, continuing without one.
Aug 27 18:58:23 kadmin.local[17982]: No dictionary file specified, continuing without one.
Aug 27 18:58:27 cf-agent[15511]: CFEngine(agent)  Q: "...du-install": Entry for principal cifs/tjener.intern with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab. Q: "...du-install": No policy specified for ldap/tjener.intern@INTERN; defaulting to no policy Q: "...du-install": Authenticating as principal root/admin@INTERN with password. Q: "...du-install": Principal "ldap/tjener.intern@INTERN" created. Q: "...du-install": Authenticating as principal root/admin@INTERN with password. Q: "...du-install": Entry for principal ldap/tjener.intern with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab WRFILE:/etc/krb5.keytab.ldap. Q: "...du-install": Entry for principal ldap/tjener.intern with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab WRFILE:/etc/krb5.keytab.ldap. Q: "...du-install": No policy specified for imap/tjener.intern@INTERN; defaulting to no policy Q: "...du-install": Authenticating as principal root/admin@INTERN with password. Q:
Aug 27 18:58:27 cf-agent[15511]: CFEngine(agent)  Last 76 quoted lines were generated by promiser '/usr/bin/ldap-debian-edu-install'
Aug 27 18:58:27 cf-agent[15511]: CFEngine(agent)  Completed execution of '/usr/bin/ldap-debian-edu-install'
---

Hi Roland,

Ok. I agree.

Good. Also works in real life.
https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/858a968950f78435101f478e736f6db9ec04ed46
https://salsa.debian.org/debian-edu/debian-edu/-/commit/d5c688a71ca771232542869e40eb3c6024df3d6f

(only in unstable for now, trixie-pu uploads are coming today).

Great! I wasn't aware of those tests (because we currently have
various missing packages in forky's Debian Edu due to some RC bugs in
e.g. sssd (affected: autofs)).

In Debian Edu 13.6, the icinga2-ido-mysql installation is done via
cfengine3 and since trixie, cfengine3 does not have a working APT
configuration anymore (or no network / no DNS in the /target chroot,
can't remember). The solution was to get all packages installed via
D-I package installation directly instead of post-install runs of APT.

Mike