[Discussion] [Solved] Disable Administrator Password For Downloading Software In Software Store

[VPW23]

Hi,

I was able to disable password requirements for logging in and when I run sudo.

However, when I go to the software store I can’t download any software without being asked for an “Administrator Password”. How do I disable that?

I entered my Debian password that I created when I installed Debian some time ago but it didn’t work.

[CwF]

I don't use a 'software store' but assume it uses polkit?

viewtopic.php?p=794907#p794907

The rule I gave there is like your sudo rule, all rights always no password, use wisely.

[VPW23]

@CwF

The app is called "Software" by The GNOME project. Software by The GNOME Project

I looked for a FAQ page for my issue and couldn't find it.

I don't think it uses polkit because I searched for it in the command line using the dpkg --list command and I get this message "dpkg-query: no packages found matching polkit".

[fabien]

Code: Select all

$> dpkg --no-pager --list "polkit"
dpkg-query: no packages found matching polkit

Code: Select all

$> dpkg --no-pager --list "polkit*"
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name                Version      Architecture Description
+++-===================-============-============-=============================================================
un  polkit-1-auth-agent <none>       <none>       (no description available)
ii  polkitd             122-3        amd64        framework for managing administrative policies and privileges
un  polkitd-javascript  <none>       <none>       (no description available)
ii  polkitd-pkla        122-3        amd64        Legacy "local authority" (.pkla) backend for polkitd

[CwF]

There is an old reference, ancient...yet in current documentation...

better security than Add/Remove Applications (i.e. use of PolicyKit instead of gksudo)

I think this software uses authentication midway within the program and not at start. The typical use would be "pkexec something". "Polkit" is not referenced. Sometime a custom executable is used, like synaptic-pkexec. Anyway what to find is the programs rule file in "/usr/share/polkit-1/actions/". Or simply ask with "pkaction" which will return all the possible things that will prompt for a password.

That's all academic. You can find the name of the action, make a rule for that one action - or just grant permission for all polkit/pkexec actions.

I'm pretty sure a current default gnome DE install has polkit setup correctly otherwise you wouldn't even get the dialog for a password.

When you create a polkit rule it is active immediately. If you have a sudo group simple use "sudo" as the username in what I posted above and you're done.

I edited above to not at start, as in the program is not running as root. This is polkit power, grant the rights for s single action - not he whole shebang.
Also, I got curious... I purged sudo and the group is not removed, so it would be a safe group. Unless you manual remove the group...

[VPW23]

@CwF

When I try to enter the rules.d folder via the GUI I get the exact same screen asking for an Administrator password as if I was trying to install an app via "Software".

So because of this, I cannot perform certain tasks because I don't have an Administrator password. I wouldn't mind creating one but I don't want to if it means I start getting asked again for a root password while running a sudo command.

I also get it when I try to change the User Account settings via the GUI.

Disabling the root password doesn't apply to disabling the Administrator GUI password.

[CwF]

Yes, there is a chicken-n-egg issue. The file needs to be created as root. For Xfce's this is an easy thing, I'd be interested to hear the gnome way to do this. If you have sudo, or with 'su -', you could use 'nano' or maybe gnome sets up 'edit'. There is likely a systemctl way to do this too! Too many ways I agree...

Disabling the root password doesn't apply to disabling the Administrator GUI password.

Did you set up the machine? Without root I thought sudo, and 'administrator' password are the same user password.

[sunrat]

Disabling the root password doesn't apply to disabling the Administrator GUI password.

What do you mean by "Administrator GUI password"? Presumably sudo password? You can set up sudo to not require a password for some or all commands. Whether that helps for Gnome software thingy I don't know, I don't use Gnome. pkexec would likely be the best option to enable that.

I consider it a good requirement to ask for a password before installing software. Maybe not so much if no-one else has access to your machine, but then there's always a chance of hacking via the internet and no password would make it simple to pwn you.

[VPW23]

@CwF

Yes, I installed Debian myself on my custom build desktop. I can run sudo commands in the command prompt without it asking for my password. But when I try to do something that requires permission with graphical applications and not the command line it asks for an "Administrator" password.

I originally wanted to post a picture of my problem but it didn't allow me because the file size was too large so I can only describe it.

[CwF]

I can only describe it.

for me, words are better!

I'd still like to hear from the gnome users...

As stated, I can't test a sudo method, but...

Code: Select all

$ sudo nano /etc/polkit-1/rules.d/42-user.rules

assuming nano is installed, then copy in - nano can paste!

Code: Select all

polkit.addRule(function(action, subject) {
    if (subject.isInGroup("sudo")) {
        return polkit.Result.YES;
    }
});

I did run through it using su -

Code: Select all

$ su -

That uses the 'root' password if you have a root account.
Again, if not root account then I thought it was the original sudo user password.

[pbear]

I'd still like to hear from the gnome users...

Can confirm the described procedure works with Gnome and Cinnamon (both D12/Bookworm).
Took effect immediately, i.e., no need to logout or reboot.
Also works with KDE (bookworm), MX-23 and LMDE6 (the latter two based on bookworm).

[VPW23]

@CwF

It didn't work. I am still being asked for an Administrator password for anything I do via GUI.

To clarify, I can run sudo commands without providing a password even before I copy and pasted the code provided.

[dlu2021]

Can confirm the described procedure works with Gnome and Cinnamon (both D12/Bookworm).
Took effect immediately, i.e., no need to logout or reboot.
Also works with KDE (bookworm), MX-23 and LMDE6 (the latter two based on bookworm).

@pbear when you did your testing did you remove the login password as well, maybe that is the difference?

[CwF]

@pbear when you did your testing did you remove the login password as well, maybe that is the difference?

This could be an issue. Is it meant user login password or administrator password, or is it no root password?
Login without a user password does not matter, I assume this may be an issue of no root password. If so we can establish a root password with sudo.

To clarify, I can run sudo commands without providing a password even before I copy and pasted the code provided.

I'm more suspicious of a typo in the copied text. The last line should end at the last character with no space or return after. Open that file, go to the end and backspace into the last character and retype the ';' and save, and try again.

If this still doesn't work then it may be the lack of a root password, polkit does use the root password. So I throw it back to the rootless gnome users for input. If the desire is to not have a root password, I have no answer.

[VPW23]

@CwF

When I open the file, there is nothing in it. Is that the case with that file? I feel like putting in the sudo nano command provided created a file, not open an existing file.

I tried your suggestion and it still didn't work. I appreciate you trying to help me out, sorry we couldn't come up with a solution.

[CwF]

When I open the file, there is nothing in it.

Then you didn't get it saved properly!
Using nano, after entering the test, hit <Ctrl><o> to 'Write Out' the file, then ctrl x to exit.
It would error at ctrl o if you did not have permission.

Originally you are not opening an existing file, you are creating one. On round two, the command would open the existing file, and if done properly, would show the previously entered text.

Code: Select all

$ sudo nano /etc/polkit-1/rules.d/42-user.rules

[VPW23]

@CwF

Still no luck. Originally, I just saved with Ctrl-X and when I reopen it without doing Ctrl-O it would show the previously entered text. I then did what you suggested and it still didn't work.

I opened my passwd- file and I see a line that says:

Code: Select all

polkitd:x:996:996:polkit:/nonexistent:/usr/sbin/nologin

[CwF]

Ok, I found an install without this rule added;
I pull "com.ubuntu.pkexec.synaptic;" from the pkla file - a competing method
I used "$ doas nano /etc/polkit-1/rules.d/42-user.rules" -doas, a competing method
pasted and used 'staff' as the group, ctrl o, ctrl x - staff, a nice useful group, maybe appropriate
and then used the menu to open synaptic without issue - synaptic, another GUI package installer

The method is sound in all my uses, thanks to the others testing.

I also have that line in passwd in the one I just successfully tested, with a root account present.

[pbear]

I can test pretty much any scenario, as I'm doing this in VirtualBox and have VMs for each bookworm desktop. @VPW23 , which desktop are you using? Just now, I tested Cinnamon after having disabled autologin and root's password (sudo passwd -l root) (don't have a VM where I didn't set the root password, and only one where I didn't set up sudo, albeit that one [Gnome] I did intentionally). CwF's procedure works fine.

As for where you're going sideways, VPW23, I notice you're skipping a step in the nano edit; between Ctrl-O and Ctrl-X, you have to confirm overwrite of the file by pressing Enter. Maybe GUI will be easier:

Code: Select all

EDITOR='gedit -w' sudoedit /etc/polkit-1/rules.d/42-user.rules

Like nano, this creates the file and opens it for editing. Paste in CwF's text, using Select All, then right-click and copy.

Code: Select all

polkit.addRule(function(action, subject) {
    if (subject.isInGroup("sudo")) {
        return polkit.Result.YES;
    }
});

Save file (Ctrl-S), then close gedit (Alt-F4). Immediately confirm file contents: sudo cat /etc/polkit-1/rules.d/42-user.rules. By the way, if you like the gedit trick, it can be added to your .bashrc file as an alias. See here.

For folks interested, a couple of links on the topic: Bookworm release notes and polkit man page.

[VPW23]

@pbear @CwF

I fixed my problem. https://linuxsimply.com/ubuntu-delete-user-password/

I used the third solution provided. It still asks for authentication but it no longer asks me to provide a password and I can click on the authenticate button where it didn't allow me to without providing a password before.