8

My server is centos 7.4 with Apache 2.4.6.
Each time when I systemctl restart httpd,2 messages will added to /var/log/secure.Looks like :

Jan 19 8:23:48 localhost polkitd[493]: Registered Authentication Agent for unix-process:5739:174943 (system bus name :1.119 [/usr/bin/pkttyagent --notify-fd 5 --fallback], object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8)
Jan 19 8:23:49 localhost polkitd[493]: Unregistered Authentication Agent for unix-process:5739:174943 (system bus name :1.119, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus)

What's the problem?

6 Answers 6

5

I had to reboot the box to fix this.

I'm sure there's a better solution, but in absence of that... kick it all over.

1
  • 2
    @iwaseatenbyagrue For me, Apache would not start at all with this error, so I figured I would answer that a reboot fixed this for me. Since nobody else at all has even responsed to this question, please accept this admittedly small amount of value added minus the criticism.
    – Marcus
    Sep 27, 2019 at 11:11
1

You can disable SELinux if systemwide security is non critical. Edit the config file found in /etc/selinux/ .Change status of SELINUX from enforcing to disabled. Save and reboot your server.

5
  • 1
    The mere suggestion could lead newcomers or other folks down the wrong path. This should at least come with a bigger, visible warning.
    – Yes Barry
    Jan 4, 2021 at 17:21
  • @YesBarry, try this tutorial cyberciti.biz/faq/…
    – lesimoes
    Feb 13, 2022 at 17:30
  • SELinux has nothing or little to do with Polkit. I can conceive of no reason why a system with SELinux enabled in permissive mode would result in this error.
    – Otheus
    Nov 9, 2022 at 12:48
  • stopdisablingselinux.com
    – ebarrere
    Feb 15, 2023 at 17:55
  • I be rather bored when stupid people repeat at vomitom disable seLinux, buy a brain instead... Aug 3, 2023 at 9:44
1

I got this message because of wrongly placed certificate and key files. Once I got these sorted with the apache config, apache started fine.

0

Check the file name. The startup script name in the unit file was different than the actual file in init.d

0

The "real" culprit is systemctl which executes /usr/bin/systemd-tty-ask-password-agent and then invokes pkttyagent, which communicates with the policykit daemon which generates the log messages. I think the idea is that systemctl first readies itself to verify from the user via the tty that it can do the operation without checking if it needs to verify the user.

You can verify that this is the case by running the command slightly differently:

systemctl --no-ask-password reload httpd

Now, the polkit message will not appear.

0

Otheus's post pointed me in the right direction. But in the end, Apache told me what was wrong. On CentOS 7 I did:

tail /var/log/httpd/error_log Which had a line like: [:error] [pid 122064] Unable to verify certificate 'Server-Cert'. Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the problem can be resolved. So I just: echo "NSSEnforceValidCerts off" >> /etc/httpd/conf.d/nss.conf

And that fixed the issue so I could fix my certs (which I couldn't do without Apache running)...

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .