#988530 base-passwd breaks amanda over SSH.

Package:
base-passwd
Source:
base-passwd
Description:
Debian base system master password and group files
Submitter:
Charles Curley
Date:
2025-01-13 18:51:01 UTC
Severity:
normal
#988530#5
Date:
2021-05-14 21:41:52 UTC
From:
To:
Dear Maintainer,

   * What led up to the situation?

   I did an upgrade from Buster to Bullseye.

   * What exactly did you do (or not do) that was effective (or
     ineffective)?

   I followed the procedure in the Bullseye release notes.
https://www.debian.org/releases/bullseye/amd64/release-notes/ch-upgrading.en.html

   * What was the outcome of this action?

   The shell for the user backup was changed from bash back to nologin,
   the value provided by base-passwd.

   I use amanda over ssh. This requires a working shell for the user
   backup. So this change broke my amanda environment on this machine.

   From the upgrade log:

       Preparing to unpack .../base-passwd_3.5.49_amd64.deb ...
       Unpacking base-passwd (3.5.49) over (3.5.46) ...
       Setting up base-passwd (3.5.49) ...
       Changing shell of backup from /bin/bash to /usr/sbin/nologin

   You can confirm that update-passwd would do this, given the chance,
   by running:

       update-passwd --dry-run
#988530#10
Date:
2021-07-17 18:26:29 UTC
From:
To:
Just had the same thing happen with version 3.5.51 on Bullseye.
#988530#15
Date:
2025-01-04 22:01:43 UTC
From:
To:
Happened again, this time on trixie.

Preparing to unpack .../base-passwd_3.6.6_amd64.deb ...
Unpacking base-passwd (3.6.6) over (3.6.5) ...
Setting up base-passwd (3.6.6) ...
Changing shell of backup from /bin/bash to /usr/sbin/nologin
1 changes have been made, rewriting files
Writing passwd-file to /etc/passwd
#988530#20
Date:
2025-01-05 01:03:06 UTC
From:
To:
As far as I can tell this is intended behaviour. Why are you running
amanda as user "backup", which has a specific, different, purpose?

Chris
#988530#25
Date:
2025-01-05 13:12:14 UTC
From:
To:
Hi amanda Maintainers,

* Charles Curley <charlescurley@charlescurley.com> [250105 03:04]:

Apparently your package uses the "backup" user. The user here
reports that to make things work, the shell has to be changed from
nologin. This seems incompatible with the base-passwd definition of
the "backup" user.

Could you please share your reasoning why you're not setting up an
amanda-dedicated user for this purpose?

Upgrades default to resetting base-passwd-defined users to what
base-passwd sees as correct.

Chris
#988530#34
Date:
2025-01-13 18:34:07 UTC
From:
To:
Hi,

I am sorry if you seen this similar email before.  I have a problem
sending email by my other account.  Let's go now about what is
important.

The choice of using account backup was made many years before me and
before base-passwd enforce the no login.  The bug 737735 have more
information about this current situation.  Changing the user account
to other will break every setup of amanda server that connects by SSH
to a debian client with other default account.  I mean breaking
servers of amanda even when not running Debian.

Personally I am happy with this kind of problem, this means that when
a other sysadmin touch a Debian a amanda client I see the problem on
next day amanda report.  So the amanda server can not run unsupervised
and the same for the clients.


Kind regards
Jose M Calhariz
#988530#39
Date:
2025-01-13 18:47:33 UTC
From:
To:
Okay, I'll leave this problem with amanda / you then :-)

Chris