# OOD desktop fails with "broken\_shadow"

**URL:** <https://discourse.openondemand.org/t/ood-desktop-fails-with-broken-shadow/3167>\
**Category:** Get Help\
**Created:** [December 19, 2023, 5:49pm UTC](https://discourse.openondemand.org/t/ood-desktop-fails-with-broken-shadow/3167 "2023-12-19T17:49:30Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![gp4r](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/gp4r/32/62_2.png) [@gp4r](https://discourse.openondemand.org/u/gp4r)\
**Post date:** [December 19, 2023, 5:49pm UTC](https://discourse.openondemand.org/t/ood-desktop-fails-with-broken-shadow/3167/1 "2023-12-19T17:49:30Z")

</div>

Hello,

We recently upgraded our Compute node to Rocky 8.7. After upgrade, we are seeing OOD desktop immediately fails. I did some investigations and noticed that “broken\_shadow” in /etc/pam.d/system-auth caused the issue.

“account required pam\_unix.so broken\_shadow”

User accounts are not a local Linux account. We use NSS DB to mange our users.  
I tried to remove “broken\_shadow” but it caused to fail to run sudo command  
“sudo: PAM account management error: Authentication service cannot retrieve authentication info”

I was wondering if you have seen this issue and help me how to fix it.  
OOD version is 3.0.3 with Rocky 8

Thank you

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [December 19, 2023, 5:52pm UTC](https://discourse.openondemand.org/t/ood-desktop-fails-with-broken-shadow/3167/2 "2023-12-19T17:52:05Z")

</div>

No I’ve never seen that issue before. We use LDAP users so I can’t really speak to NSS DB.

---

<div class="post-metadata">

**Author:** ![gp4r](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/gp4r/32/62_2.png) [@gp4r](https://discourse.openondemand.org/u/gp4r)\
**Post date:** [December 20, 2023, 1:57pm UTC](https://discourse.openondemand.org/t/ood-desktop-fails-with-broken-shadow/3167/3 "2023-12-20T13:57:03Z")

</div>

Jeff, thank you for your response.

I did some more test and it doesn’t related to nss-db. I just tried it using a local Linux account but it OOD desktop failed when I set "account required pam\_unix.so broken\_shadow” in /etc/pam.d/system-auth

Not sure why setting `broken_shadow` for `pam_unix.so` is breaking OOD desktop sessions.

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [December 20, 2023, 2:33pm UTC](https://discourse.openondemand.org/t/ood-desktop-fails-with-broken-shadow/3167/4 "2023-12-20T14:33:40Z")

</div>

Sorry, I’m not sure how much help I can be here.

> [@gp4r](#):
>
> Not sure why setting `broken_shadow` for `pam_unix.so` is breaking OOD desktop sessions.

I reckon it’s because systemd + DBUS start these X11 sessions. That’s PID 1 as the parent process that needs to fork and start these children.

Are you quite sure that’s the error? I think of the phrase `when you hear hooves, think horses, not zebras` which means, when you see an issue it’s likely something more common, not some esoteric/highly specialized one off. (i.e., horses are far more common in the USA than zebras)

---

<div class="post-metadata">

**Author:** ![gp4r](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/gp4r/32/62_2.png) [@gp4r](https://discourse.openondemand.org/u/gp4r)\
**Post date:** [February 1, 2024, 2:35pm UTC](https://discourse.openondemand.org/t/ood-desktop-fails-with-broken-shadow/3167/5 "2024-02-01T14:35:56Z")

</div>

Jeff,

We saw this topic [Could not connect to session bus](https://discourse.openondemand.org/t/could-not-connect-to-session-bus/1950) and added  
`/usr/bin/loginctl enable-linger $SLURM_JOB_USER` into `script.sh.erb`

After that, it worked fine.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [July 30, 2024, 2:36pm UTC](https://discourse.openondemand.org/t/ood-desktop-fails-with-broken-shadow/3167/6 "2024-07-30T14:36:04Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.