Univention Bugzilla – Bug 49910
Disable pam_systemd by default
Last modified: 2022-02-22 16:06:47 CET
With Bug #47233 we enabled pam_systemd to terminate ssh sessions when the server reboots or is shut down. Unfortunately this has two negative side effects: - for each user a `systemd --user` is started, which remains even after exit. On servers (running Samba) this leads to many extra processes consuming valuable system resources like RAM and already lead to processes being killed by OOM. - for each session the modules creates a new CGroup, which "leaks" memory in the Linux kernel (Bug #49614): In-kernel memory structures are still associated with the CGroup even after all processes have terminated, which prevents the CGroup from being freed finally. 1. Disable the PAM module by default 2. Add a new UCR variable to enable it on demand.
[4.4-1] e9dbd51b28 Bug #49910 pam: Fix swapped UCRV descriptions .../debian/univention-pam.univention-config-registry | 1 + .../debian/univention-pam.univention-config-registry-variables | 8 ++++---- 2 files changed, 5 insertions(+), 4 deletions(-) [4.4-1] 43ff7804c3 Bug #49910 pam: Disable pam_systemd by default .../conffiles/etc/pam.d/common-session.d/10univention-pam_common | 2 +- base/univention-pam/debian/changelog | 6 ++++++ .../debian/univention-pam.univention-config-registry-variables | 6 ++++++ 3 files changed, 13 insertions(+), 1 deletion(-) Package: univention-pam Version: 12.0.2-3A~4.4.0.201907231200 Branch: ucs_4.4-0 Scope: errata4.4-1 [4.4-1] ea9378acb3 Bug #35173: univention-pam 12.0.2-3A~4.4.0.201907231200 doc/errata/staging/univention-pam.yaml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) QA: grep --color pam_systemd /etc/pam.d/common-session ucr set pam/session/systemd=1 grep --color pam_systemd /etc/pam.d/common-session ucr set pam/session/systemd=0 grep --color pam_systemd /etc/pam.d/common-session ucr unset pam/session/systemd grep --color pam_systemd /etc/pam.d/common-session
<http://errata.software-univention.de/ucs/4.4/191.html>