Join Log in
Score:2
avatar Server

CentOS: Admin user on xrdp session can't do admin

es flag
kbro

I'm running a Rocky Linux 8.4 workstation with GNOME and MATE desktops, but I've seen the same problem on CentOS 7.9...

When I log into the machine on the local display, I can do things like administer users and set the system time using the Control Centre app (this on MATE, the tools are buried in the menu on GNOME). When I click on the tool I'll get a popup asking for my password, or there will be an "unlock" button to click before I get authenticated. This all works because my user is a member of the "wheel" administrative group.

However, when the same user logs in to the same desktop environment over xrdp, the ability to administer the system has gone. In some cases the "unlock" button is greyed out, in others when I click on the tool app icon I get a message "Error executing command as another user: Not authorized" in my .xsession-errors file.

As I understand it, the problem is down to polkit treating local and remote sessions differently, and basically blocking administrative actions from remote sessions such as xrdp, vnc etc. This is a pain, because the main reason for setting up the xrdp service was so that I could administer the machine remotely! I can work around this to some extent using sudo from a terminal, but really I want it to Just Work™.

So my question is - how do I configure polkit to treat a remote session for my admin user identically to a local session? (Always assuming that polkit is the source of my problem!)

124
0 + 0
vnc
Score:1
avatar Server
es flag
kbro

Having framed yesterday's frustrations more succinctly, I used a well-known search engine to look for "linux polkit local and remote sessions" and got this as the top result - Enabling system management privileges for non-local users - How the heck does polkit work, anyways? The answer (slightly modified from the linked question) is to create a file /etc/polkit-1/localauthority/50-local.d/10-remote-admin-allow.pkla containing

[Allow Remote Admin]
Identity=unix-group:wheel
Action=*
ResultAny=auth_admin_keep
ResultInactive=auth_admin_keep
ResultActive=auth_admin_keep

and run systemctl restart polkit (which is vital but was missed in the other question). You can also put this file under /var/lib/polkit-1, but according to pklocalauthority.8 the former is intended for local configuration while the latter is for 3rd party packages.

0 + 0
Score:0
sqwuade avatar Server
lr flag
sqwuade

Worked great for me. Thanks!

I wasn't sure what "Identity=unix-group:wheel" was so I changed the group to 'sudo' instead. I'm guessing 'users' group would have worked as well.

I'm running Linux Lite 6.0 BTW.

Cheers!

+ 2
es flag
kbro
RedHat and derivatives use the “wheel” group for users who can become root. Ubuntu (and maybe other Debian derivatives) use the “sudo” group for that purpose.
0
Reply
sqwuade avatar
lr flag
sqwuade
Ok, good to know. I used to run Redhat/Fedora but moved over to Ubuntu/Mint/Debian around 10 years ago on the recommendation of a friend. Yep, "sudo" is pretty much ubiquitous in Debian land. Do you ever run webmin? I'm having a bizarre issue running it on the Linux Lite OS. It ran w/o issue on Linux Mint.
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.