1

I upgraded to saucy not too long ago and now an X11 user can shutdown even if I'm connected to that computer via ssh.

Before the upgrade, an ssh connection would prevent the X11 users from shutting down (at least with the regular Shutdown menu option.)

How can I re-establish that feature so if I am doing an upgrade the X11 users cannot just turn off their computer on me?

Update:

Look at the accepted answer on Prevent machine from sleeping when SSH connections are on which includes a solution using systemd-inhibitor which probably the way to go. I'm not too sure how you can integrate that functionality in SSH but that would be the modern way (since 15.04). The inhibitor can prevent sleep, shutdown, reboot, hibernation... you name it.

Alexis Wilke
  • 2,707

1 Answers1

0

Check if the following entries in the file /usr/share/polkit-1/actions/org.freedesktop.consolekit.policy are set correctly. They handle the behavior of shutdown/restart requests via the PolicyKit daemon:

  <action id="org.freedesktop.consolekit.system.stop-multiple-users">
    <description>Stop the system when multiple users are logged in</description>
    <message>System policy prevents stopping the system when other users are logged in</message>
    <defaults>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
  </action>

  <action id="org.freedesktop.consolekit.system.restart-multiple-users">
    <description>Restart the system when multiple users are logged in</description>
    <message>System policy prevents restarting the system when other users are logged in</message>
    <defaults>
      <allow_inactive>no</allow_inactive>
      <allow_active>auth_admin_keep</allow_active>
    </defaults>
  </action>

Both should be configured that allow_active statements show auth_admin_keep, which means that administrative user authentication is required to perform this action. Notice that when a user is in the administrative group (sudo, admin), this user CAN shutdown even if you are logged in.

You have 2 options: Remove the user from this group or set allow_active to no.

chaos
  • 27,506
  • 12
  • 74
  • 77
  • The users are not sudoers and not admin, just plain users. And the allow_active tag is set to "auth_admin_keep". Yet it still shuts me off. Just in case, I compared that file with the one I have on a 13.04 system and they are the same... so I guess it's not just that. Any other idea? Or should I just put "no" in there? (it seems to me that it should still work as before... so there must be something else that bypasses this policy?) – Alexis Wilke Feb 22 '14 at 05:32
  • As a "side" note, I had a problem with the motd. It would not show up when I ssh'ed in the servers. To fix that problem I just had to add the symbolic link /etc/motd -> /var/run/motd and it worked again. Could there be such a symbolic link lost in this case too? – Alexis Wilke Feb 23 '14 at 05:28