29

I have a strange issue whenever trying to stop/start a daemon as a regular user, it asks to authenticate with the credentials of another regular user - for example:

[bob@server ~]$ systemctl stop some-daemon.service
==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units ===
Authentication is required to manage system services or units.
Authenticating as: alice
Password:

Why is it asking for alice to authenticate when bob is logged in, and how do I fix this?

Improve this question
9
  • What does the service config file look like? – Jenny D Mar 29 '17 at 14:02
  • @JennyD: Where is the file location of the config? – Jack O'Leary Mar 29 '17 at 14:05
  • What you want? You want start own copy service for each user? E.g. start own VNC-daemon for alice and own VNC-daemon for bob? – Alexander Tolkachev Mar 29 '17 at 15:25
  • @AlexanderT: Each user needs to have their own vncserver, that's how it's designed, so yes - that is more or less it. Bob isn't running a vnc server though, he's running something unrelated, yet when he tries to start it systemctl asks for alice's password... ( shrug ). – Jack O'Leary Mar 29 '17 at 17:47
  • @JackO'Leary, you could try to use systemd --user as it described in this article. Otherwise, you could give sudo for each user for required services. – Alexander Tolkachev Mar 29 '17 at 20:03
11

Your system is using the polkit Authorization Manager and the message is from the file /usr/share/polkit-1/actions/org.freedesktop.systemd1.policy. polkit can be configured in /etc/polkit-1 and /usr/share/polkit-1 directories, more specifically in the rules.d and actions subdirectories. See the Polkit man page for more information.

Improve this answer
6
  • From the documentation: "polkit allows users to obtain temporary authorization through authenticating either an administrative user or the owner of the session the client belongs to." Maybe this can give a clue to why it is asking for alice's password. – Johan Myréen Mar 29 '17 at 14:35
  • I think you're onto something here, although I'm still completely lost on where to remove the rule or whatever it is of the other user that keeps asking to authenticate. I looked in both of those directories and even did a grep for "alice" and nothing was returned. – Jack O'Leary Mar 29 '17 at 14:37
  • You said earlier that you did a su - alice before starting the vnc daemon. I guess that makes alice the "owner of the session the client belongs to". – Johan Myréen Mar 29 '17 at 14:46
  • What doesn't make sense though was that it was only done for one service, which was then stopped and the user logged out. The other service for bob shouldn't have anything to do with alice as it was something completely different — It's very strange ... I wouldn't mind disabling polkit altogether if this is what it's normal behavior is like. – Jack O'Leary Mar 29 '17 at 14:51
  • You can find out who the owner of the session is with the loginctl command. This could confirm or disprove my theory that polkit is asking the owner of the session to authenticate. I really can't say why alice is the owner in this case. – Johan Myréen Mar 29 '17 at 18:26
11

When managing system services, you need to do it as root not as normal user. This is indicated by $ character at the end of shell prompt.

You can either use sudo command or switch to root (root shell usually indicated by # char).

Improve this answer
2
  • 1
    Even If I'm doing it as root it asks for the normal users authentication. Basically the root user did su - alice, then systemctl to start their vnc daemon, but now it asks for their authentication for every systemctl no matter what it is... – Jack O'Leary Mar 29 '17 at 13:51
  • I got the error message when I typed '/etc/init.d/munge start'. Adding sudo fixed it. Thanks! – fchen Jul 22 '18 at 18:25
1

Check /etc/groups and sudoers rule. This can happen if a person added themselves to the wheel group and became root that way.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.