After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 696337 - Creating administrator account without setting password prevents all actions that require authentication
Creating administrator account without setting password prevents all actions ...
Status: RESOLVED DUPLICATE of bug 690246
Product: gnome-control-center
Classification: Core
Component: User Accounts
3.7.x
Other Linux
: Normal major
: ---
Assigned To: Control-Center Maintainers
Control-Center Maintainers
Depends on:
Blocks:
 
 
Reported: 2013-03-21 21:40 UTC by Michael Catanzaro
Modified: 2013-07-18 02:44 UTC
See Also:
GNOME target: ---
GNOME version: ---



Description Michael Catanzaro 2013-03-21 21:40:31 UTC
I'm running GNOME 3.7.92 from a live CD for the Fedora test day. I started creating new user accounts with various settings to see if I could break anything. I set one of the new accounts to "Administrator" instead of "Standard", left him on "Account Disabled", and did something to get the panel locked (whether leaving the panel, or closing Settings, or just clicking the toggle, I don't remember). This is the only "Administrator" account on my system. Now, when I try to do anything that requires authentication, polkit prompts for this users's password, even though he has none set. Blank passwords are rejected, so I cannot log in.

I then set a password for the root user (since this was a live session) by using passwd directly, hoping both to simulate a more typical scenario where root has a password, and that I'd then be prompted for the root password instead of this user's nonexistent password. No such luck - polkit still wants a password for my throwaway, passwordless user.  If I didn't know how to use passwd to fix this, I'd never be able to perform administrative actions again.

After manually setting a password for this user with passwd, I was obviously able to authenticate as him without issues. I then changed his password type to "login without password" and closed Settings. With an admin set to login without a password I was able to perform privileged actions without any authentication at all, which makes sense for this scenario, so the problem only exists if the account is left as "account disabled."
Comment 1 Michael Catanzaro 2013-03-21 21:41:59 UTC
Correction: "Blank passwords are rejected, so I cannot AUTHENTICATE." (Of course I shouldn't be able to log in if it's disabled!)
Comment 2 Matthias Clasen 2013-03-22 15:48:08 UTC
The .medium term plan for fixing this (and other) issues is to always require  a password to  be set
Comment 3 Ondrej Holy 2013-07-17 15:41:47 UTC
I can't reproduce it. I think it has been fixed for Gnome 3.8 by Bug 700715 and Bug 690246. Could you confirm it?
Comment 4 Michael Catanzaro 2013-07-18 02:44:40 UTC
Yup.  Users panel is a lot safer than it was just a few months ago.

*** This bug has been marked as a duplicate of bug 690246 ***