Dear Maintainer,

I'm installed freedombox in a systemd container. Networking is managed by systemd.network
with NetworkManager configured to ignore all the interfaces. I needed to install btrfs-progs.

I was then able to access the https://cass.6site0/freedombox URL and paste in my secret.
I entered an account called owner and gave it a password. I performed an upgrade.

I then tried to add some SSH keys and add a user. I received
some failure messages from the plinth logs.

Sep 01 18:18:13 cass freedombox[171]: » ssh..set_keys("owner", "", "owner", ****)
Sep 01 18:18:13 cass freedombox[171]: Error running action ssh..set_keys("owner", "", "owner", ****): Permissi
onError("Invalid credentials")
                                      Action traceback:
                                      ╞   File "/usr/lib/python3/dist-packages/plinth/actions.py", line 501, i
n _privileged_call
                                      ╞     return_values = func(*arguments['args'], **arguments['kwargs'])
                                      ╞   File "/usr/lib/python3/dist-packages/plinth/modules/ssh/privileged.p
y", line 98, in set_keys
                                      ╞     _validate_user(auth_user, auth_password, must_be_admin=must_be_adm
in)
                                      ╞     ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
^^^
                                      ╞   File "/usr/lib/python3/dist-packages/plinth/modules/ssh/privileged.py", line 32, in _validate_user
                                      ╞     raise PermissionError('Invalid credentials')
Sep 01 18:18:14 cass freedombox[171]: GET /sys/users/owner/edit/

I may have incorrectly entered the owner password in that one, but later

Sep 01 18:18:14 cass freedombox[171]: GET /sys/users/owner/edit/

Sep 01 18:18:14 cass freedombox[171]: » ssh..get_keys("owner")

Sep 01 18:18:14 cass freedombox[171]: » users..get_group_users("admin")

Sep 01 18:20:25 cass freedombox[171]: POST /sys/users/owner/edit/

Sep 01 18:20:25 cass freedombox[171]: » ssh..get_keys("owner")

Sep 01 18:20:25 cass freedombox[171]: » users..get_group_users("admin")

Sep 01 18:20:25 cass freedombox[171]: » users..get_user_groups("owner")

Sep 01 18:20:25 cass freedombox[171]: » ssh..set_keys("owner", "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJY8q6TDObPW524Vna/2UT6PBgV05nD5n77D+mbyVAnW weaves-elliptic", "owner", ****)

Sep 01 18:20:25 cass freedombox[171]: Error running action ssh..set_keys("owner", "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJY8q6TDObPW524Vna/2UT6PBgV05nD5n77D+mbyVAnW weaves-elliptic", "owner", ****): PermissionError("Invalid credentials")

                                      Action traceback:

                                      ╞   File "/usr/lib/python3/dist-packages/plinth/actions.py", line 501, in _privileged_call

                                      ╞     return_values = func(*arguments['args'], **arguments['kwargs'])

                                      ╞   File "/usr/lib/python3/dist-packages/plinth/modules/ssh/privileged.py", line 98, in set_keys

                                      ╞     _validate_user(auth_user, auth_password, must_be_admin=must_be_admin)

                                      ╞     ~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

                                      ╞   File "/usr/lib/python3/dist-packages/plinth/modules/ssh/privileged.py", line 32, in _validate_user

                                      ╞     raise PermissionError('Invalid credentials')

Sep 01 18:20:25 cass freedombox[171]: GET /sys/users/owner/edit/


In that one,  I may have gotten further. I did manage to get the notification that the Authorization Password
worked, but something else failed.

I suspected that the LDAP password wasn't working because most of the error were invalid credentials after an
LDAP operation.

I went out to the OS command line and tried to change the password of the only account in LDAP the owner
account. And the LDAP password I entered during the LDAP/nslcd installation didn't work.

The /etc/nslcd.conf file looks incomplete:

# The DN to bind with for normal lookups.
#binddn cn=annonymous,dc=example,dc=net
#bindpw secret

# The DN used for password modifications by root.
#rootpwmoddn cn=admin,dc=example,dc=com

Despite trying to create two users - neither appeared on the file system.

So I think it is a broken distribution. There's something wrong with the linkage between plinth and
the LDAP.

This is typically not supported and not well tested.  However, it would
be a welcome change to fix any bugs and document running in a container.
  We *do* development using systemd-nspawn.  So, it should not be too hard.

Some notes about how the nspawn container should be run:

- Boot=yes (this is needed so that systemd is started in the container,
this is a requirement for running other daemons etc.)

- VirtualEthernet=yes (if the container has no separate network name
space, then listening on some ports may not be possible due to
privileges and clashes)

- PrivateUsers=no (since root privileges are used by FreedomBox, I am
not sure what functions would fail without this)

- Container should be setup such that FreedomBox can create and manage
containers within the container.  This is needed for some optional apps.
In development we simply do SystemCallFilter=@known.

This should be fine.  However, firewalld will assign all interfaces as
"external" interfaces.

I wonder why that was needed.  We can fix this.
 >

If things have progressed this far, it is likely some of the important
conditions listed above must have been met.
[...]
[...]
[...]

This is failing with validation of username and password pair.  For this
to work password must be the password of the user who is modifying the
account or password of the admin user modifying the account. In your
case this must be the password for the "owner" user.

What's failing is this:

import pam
pam_authenticator = pam.pam()
pam_authenticator.authenticate("owner", "owner'spassword")

Are the slapd and nslcd services running?

systemctl status slapd.service
systemctl status nslcd.service

What happens if you try to 'su -' into this account from a non-admin
account.

(non-admin user)$ su - owner
Password: (type the password you provided in the web form for editing
the SSH keys)

What happens if you try this:

(admin user)# id owner

Output should be like:
uid=10001(owner) gid=100(users) groups=100(users),10002(admin)

(admin user)# getent passwd owner

Output should be like:
owner:*:10001:100:tester:/home/owner:/bin/bash
 > > The /etc/nslcd.conf file looks incomplete:

The LDAP password entered during the installation of slapd package is
not used by FreedomBox at all.  FreedomBox uses a different
authentication mechanism with slapd that verifies admin privileges and
skips asking for admin password.  That password also has no relationship
with the password entered in the web interface for authorizing user
operations.

If you wish to change the password for the user and the web interface
does not work, then try the 'freedombox-change-password' command like this:

# freedombox-change-password owner

Hope this helps,