systemd: Add lastlog2 support for "last login" health card item #21176

martinpitt · 2024-10-28T13:08:14Z

Latest debian testing dropped support for the old wtmp/lastlog stack. Other distributions will follow soon.

The extra debian-testing/{other,expensive}@Bots #7033 tests here prove that this works.

martinpitt · 2024-10-28T13:57:36Z

This lastlog2 parsery is just gross.. I'll reattempt this with Python, I just discovered that sqlite3 is an included battery.

# python3 -m sqlite3 /var/lib/lastlog/lastlog2.db 'SELECT * FROM Lastlog2'
('debian', 1730109226, '', '::ffff:172.27.0.2', 'cockpit')
('admin', 1730120286, '', '::ffff:172.27.0.2', 'cockpit')
('root', 1730123689, 'ssh', '172.27.0.2', 'sshd')

Update: As the failures on old OSes show, it's not only gross, but wrong:

# lastlog
Username         Port     From                                       Latest
root             pts/0    172.27.0.2                                Mon Oct 28 16:01:08 +0000 2024
daemon                                                              **Never logged in**

There is no hope of parsing this properly. I'll leave lastlog1 parsing as-is, and re-do lastlog2 as SQL.

martinpitt · 2024-10-29T16:28:55Z

This flake is rather annoying.. As this test touches the users page, they all have to pass 3x. "Unexpected error when getting locked account information" sounds rather unrelated.

I tried this locally, and it passed 10 times in a row. Polluted VM from a previous test? -- No, I ran the exact same tests in the same order as in CI, and it passes.

Failed to try-restart sssd.service: Unit sssd.service not found.

warn: Unexpected error when getting locked account information Object(5)

These happen in successful runs, too..

Job for systemd-logind.service canceled.

This on the other hand doesn't, so may be related to the terminate_sessions() failure.

Moving to draft, and amplifying/debugging.

martinpitt · 2024-10-30T07:36:03Z

Cool, works! Good enough.

pkg/systemd/overview-cards/lastLogin.jsx

This avoids calling `cockpit.LoginMessages` and `cockpit.user` multiple times during each initialization, and simplifies the structure.

We'll soon need more information (tty and remote host) from lastlog2. This is impossible to parse from the `lastlog[2]` CLI: With modern versions and their variable-width multi-space-separated columns it's merely hard and gross, but older `lastlog` versions misalign the columns. So give up on this, and read lastlog2's sqlite database directly. Fortunately Python comes with the `sqlite3` module built in. This also gets rid of the brittle date/time parsing. Make this a library, as we will use it from the Overview page as well.

Phase out the last login information from cockpit-session. With distributions moving to lastlog2 [1], we can get that information from the Overview page directly. For now, support both sources. [1] cockpit-project/bots#7033

Otherwise in our test logs it comes out as "Object(5)", which is useless.

Log out the root session at the end. This helps with stopping logind in our test cleanup. DRY, use `login_and_go()` to drive the login page.

mvollmer · 2024-10-30T09:23:20Z

pkg/lib/lastlog2.py

+
+con = sqlite3.connect(DB)
+cur = con.cursor()
+query = "SELECT Name, Time, TTY, RemoteHost FROM Lastlog2"


Is the schema documented somewhere?

I just got it from .schema in sqlite3. The manpage doesn't document it. Otherwise, it's just in the upstream source code.

The format doesn't look prone to changes, but of course it could happen in principle. Then our tests should pick it up and we need to deal with it.

mvollmer

Nice, thanks!

cockpituous · 2024-10-30T10:06:11Z

pkg/lib/logins.ts

+    const out = await python.spawn(lastlog2_py, user ? [user] : [], { err: "message" });
+    return JSON.parse(out);


These 2 added lines are not executed by any test.

cockpituous · 2024-10-30T10:06:11Z

pkg/systemd/overview-cards/lastLogin.jsx

+            } else {
+                // empty reply is okay -- older bridges just don't send that information
+                if (obj.version !== undefined)
+                    console.error("unknown login-messages:", reply);


This added line is not executed by any test.

cockpituous · 2024-10-30T10:06:11Z

pkg/systemd/overview-cards/lastLogin.jsx

+        } catch (error) {
+            console.error("failed to fetch login messages:", error);


These 2 added lines are not executed by any test.

cockpituous · 2024-10-30T10:06:11Z

pkg/systemd/overview-cards/lastLogin.jsx

+            setLastlog((await getLastlog2(user.name))[user.name]);
+        } catch (error) {


These 2 added lines are not executed by any test.

cockpituous · 2024-10-30T10:06:12Z

pkg/systemd/overview-cards/lastLogin.jsx


-    if (messages === null || !messages['last-login-time']) {
+    const lastLoginTime = messages?.['last-login-time'] ?? lastlog?.time;


This added line is not executed by any test.

cockpituous · 2024-10-30T10:06:12Z

pkg/systemd/overview-cards/lastLogin.jsx

+    const lastLoginFrom = messages?.['last-login-host'] || lastlog?.from;
+    const lastLoginPort = messages?.['last-login-line'] || lastlog?.port;


These 2 added lines are not executed by any test.

cockpituous · 2024-10-30T10:06:12Z

pkg/users/users.js

@@ -207,43 +208,42 @@ async function getLoginDetails(logind_client) {
                        details[name] = { ...details[name], isLocked: hash.startsWith("!") };
                }
            } catch (err) {
-                console.warn("Unexpected error when getting locked accounts from /etc/shadow:", err);
+                console.warn("Unexpected error when getting locked accounts from /etc/shadow:", err.toString());


This added line is not executed by any test.

cockpituous · 2024-10-30T10:06:12Z

pkg/users/users.js

+        for (const [name, last] of Object.entries(await getLastlog2()))
+            details[name] = { ...details[name], lastLogin: last.time * 1000 };
+    } catch (err) {


These 3 added lines are not executed by any test.

cockpituous · 2024-10-30T10:06:12Z

pkg/users/users.js

+                } catch (e) {
+                    console.warn(`Failed to parse date from lastlog line '${line}': ${e.toString()}`);


These 2 added lines are not executed by any test.

cockpituous · 2024-10-30T10:06:12Z

pkg/users/users.js

+        } catch (ex) {
+            console.warn(`Failed to run lastlog: ${ex.toString()}`);


These 2 added lines are not executed by any test.

martinpitt mentioned this pull request Oct 28, 2024

Image refresh for debian-testing cockpit-project/bots#7033

Merged

3 tasks

martinpitt marked this pull request as draft October 28, 2024 13:56

martinpitt force-pushed the health-last-login branch 2 times, most recently from f0a1291 to 8d31bbc Compare October 29, 2024 09:46

martinpitt marked this pull request as ready for review October 29, 2024 09:46

martinpitt requested a review from mvollmer October 29, 2024 09:46

martinpitt self-assigned this Oct 29, 2024

martinpitt marked this pull request as draft October 29, 2024 18:34

martinpitt removed the request for review from mvollmer October 29, 2024 18:34

martinpitt added the no-test For doc/workflow changes, or experiments which don't need a full CI run, label Oct 30, 2024

martinpitt force-pushed the health-last-login branch from 8d31bbc to 9db5989 Compare October 30, 2024 07:13

martinpitt removed the no-test For doc/workflow changes, or experiments which don't need a full CI run, label Oct 30, 2024

martinpitt force-pushed the health-last-login branch from 9db5989 to 3906b8f Compare October 30, 2024 07:36

martinpitt marked this pull request as ready for review October 30, 2024 07:36

martinpitt requested a review from mvollmer October 30, 2024 07:36

mvollmer reviewed Oct 30, 2024

View reviewed changes

pkg/systemd/overview-cards/lastLogin.jsx Outdated Show resolved Hide resolved

martinpitt added 5 commits October 30, 2024 10:12

systemd: Rewrite LastLogin init with useInit and async

6ef0163

This avoids calling `cockpit.LoginMessages` and `cockpit.user` multiple times during each initialization, and simplifies the structure.

users: Stringify passwd -S --all console message

753d275

Otherwise in our test logs it comes out as "Object(5)", which is useless.

test: Robustify TestAccounts.testRootLogin

0362e07

Log out the root session at the end. This helps with stopping logind in our test cleanup. DRY, use `login_and_go()` to drive the login page.

martinpitt force-pushed the health-last-login branch from 3906b8f to 0362e07 Compare October 30, 2024 09:13

mvollmer reviewed Oct 30, 2024

View reviewed changes

mvollmer approved these changes Oct 30, 2024

View reviewed changes

cockpituous reviewed Oct 30, 2024

View reviewed changes

martinpitt merged commit fc28500 into cockpit-project:main Oct 30, 2024
86 of 87 checks passed

martinpitt deleted the health-last-login branch October 30, 2024 10:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

systemd: Add lastlog2 support for "last login" health card item #21176

systemd: Add lastlog2 support for "last login" health card item #21176

martinpitt commented Oct 28, 2024 •

edited

Loading

martinpitt commented Oct 28, 2024 •

edited

Loading

martinpitt commented Oct 29, 2024 •

edited

Loading

martinpitt commented Oct 30, 2024

mvollmer Oct 30, 2024

martinpitt Oct 30, 2024

mvollmer left a comment

cockpituous Oct 30, 2024

cockpituous Oct 30, 2024

cockpituous Oct 30, 2024

cockpituous Oct 30, 2024

cockpituous Oct 30, 2024

cockpituous Oct 30, 2024

cockpituous Oct 30, 2024

cockpituous Oct 30, 2024

cockpituous Oct 30, 2024

cockpituous Oct 30, 2024

		const out = await python.spawn(lastlog2_py, user ? [user] : [], { err: "message" });
		return JSON.parse(out);

		} catch (error) {
		console.error("failed to fetch login messages:", error);

		setLastlog((await getLastlog2(user.name))[user.name]);
		} catch (error) {


		if (messages === null \|\| !messages['last-login-time']) {
		const lastLoginTime = messages?.['last-login-time'] ?? lastlog?.time;

		const lastLoginFrom = messages?.['last-login-host'] \|\| lastlog?.from;
		const lastLoginPort = messages?.['last-login-line'] \|\| lastlog?.port;

		} catch (e) {
		console.warn(`Failed to parse date from lastlog line '${line}': ${e.toString()}`);

		} catch (ex) {
		console.warn(`Failed to run lastlog: ${ex.toString()}`);

systemd: Add lastlog2 support for "last login" health card item #21176

systemd: Add lastlog2 support for "last login" health card item #21176

Conversation

martinpitt commented Oct 28, 2024 • edited Loading

martinpitt commented Oct 28, 2024 • edited Loading

martinpitt commented Oct 29, 2024 • edited Loading

martinpitt commented Oct 30, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mvollmer left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

martinpitt commented Oct 28, 2024 •

edited

Loading

martinpitt commented Oct 28, 2024 •

edited

Loading

martinpitt commented Oct 29, 2024 •

edited

Loading