Arch Linux

I've seen same message "gpasswd: nscd did not terminate normally (signal 11)" but "sudo gpasswd -a lee kvm" works successfully. I guess in your case it worked also.

Tommy, that day I was convinced `gpasswd` wasn't changing `/etc/group`, but today after testing, it does seem to be working even with the signal 11 errors.


$ sudo useradd testuser

$ grep testuser /etc/group
testuser:x:1003:

$ sudo gpasswd -a testuser kvm
Adding user testuser to group kvm
gpasswd: nscd did not terminate normally (signal 11)
gpasswd: nscd did not terminate normally (signal 11)
gpasswd: nscd did not terminate normally (signal 11)

$ grep testuser /etc/group
kvm:x:78:testuser
testuser:x:1003:

Description:
passwd: nscd did not terminate normally (signal 11)

Package versions:
* core/shadow 4.8.1-4
* usr/bin/passwd
* core/glibc 2.32-5
* usr/bin/nscd

Steps to reproduce:
1. Install Arch Linux (including sudo package) from latest installation image (2021.02.01);
2. Login as root;
3. % useradd -m someuser && passwd someuser && echo 'someuser ALL=(ALL) ALL' > /etc/sudoers.d/01_something && chmod 400 /etc/sudoers.d/01_something
4. Login as someuser;
5. $ sudo passwd -l root
passwd: nscd did not terminate normally (signal 11)
passwd: nscd did not terminate normally (signal 11)
passwd: nscd did not terminate normally (signal 11)
passwd: nscd did not terminate normally (signal 11)
Passwd: password expiry information changed.
6. $ logout

After these actions, I can no longer login as a user (and as root). I added a new user using arch-chroot, but he can't login too.

Then I reinstalled the system and repeated the same steps with the same result. Complete lockdown of all.

How do I unblock everyone/someone? I don't want to reinstall the system again.

Fresh system installation (glibc 2.33-4):

$ sudo passwd -l root
passwd: nscd did not terminate normally (signal 11)
passwd: nscd did not terminate normally (signal 11)
passwd: nscd did not terminate normally (signal 11)
passwd: nscd did not terminate normally (signal 11)
Passwd: password expiry information changed.

But I was able to log in. That's progress! :)

nscd is a separate package in Debian (https://packages.debian.org/sid/nscd).
From the package description: "You should install this package only if you use slow services like LDAP, NIS or NIS+".

Is it possible and necessary to separate glibc and nscd in Arch Linux?

The error message comes from shadow pkg.

AFAICT nscd is not enabled by default in Arch. Did you manually enable it? Please show the output of:

systemctl status nscd

FWIW, Fedora are actively deprecating nscd (then planning to remove it entirely) [1]

[1]: https://fedoraproject.org/wiki/Changes/RemoveNSCD

No. I never enabled nscd.service manually.

$ systemctl status nscd
● nscd.service - Name Service Cache Daemon
Loaded: loaded (/usr/lib/systemd/system/nscd.service; disabled; vendor preset: disabled)
Active: inactive (dead)

journalctl doesn't say anything about nscd.

Fedora is already using sssd by default.
Debian does not use nscd and sssd (these packages are not installed) by default.
I don't know how it works in Debian yet.

Is this still an issue with glibc-2.35-2?

# passwd -d root
passwd: nscd did not terminate normally (signal 11)
passwd: nscd did not terminate normally (signal 11)
passwd: nscd did not terminate normally (signal 11)
passwd: nscd did not terminate normally (signal 11)
passwd: password changed.

# pacman -Q glibc
glibc 2.36-6

As mentioned previously, this error message is coming from the shadow pkg. There have been lots of shadow updates lately and no glibc updates. I cannot repro this in a VM. Please provide exact steps and conditions to reliably reproduce.

Sure. This error happens when using linux-hardened kernel, but not on normal linux kernel.

@vedranmiletic: I can reproduce this locally.

However, this does not seem to be a problem for passwd in regards to changing/removing the password. The return code is still 0.

It's probably worth reporting this upstream.

FWIW: We can remove support for nscd in shadow during configure.
As I am personally not using nscd, I don't really know though whether there is a use-case we should be aware of before doing so.

This is an automated comment as this bug is open for more then 2 years. Please reply if you still experience this bug otherwise this issue will be closed after 1 month.

can confirm the bug is still present on linux-hardened 6.4.14.hardened1-1, shadow 4.13-2 and glibc 2.38-3:

$ sudo passwd -l root
passwd: nscd did not terminate normally (signal 11)
passwd: nscd did not terminate normally (signal 11)
passwd: nscd did not terminate normally (signal 11)
passwd: nscd did not terminate normally (signal 11)
passwd: password changed.

@seqfault could you open an upstream bug report if there is not one already? In your use case could nscd be replaced by sssd?

@loqs I have no idea what nscd and sssd are, I'm just a regular user, who reported warnings after googling them. also, passwd -l root worked for me

With https://bugs.archlinux.org/task/79736 there's now a ticket open to remove the use of nscd altogether and it is likely to be implemented.

great! no more warnings I hope

Please check glibc and shadow in testing