Authentication by VBoxAuth always fails when process (e.g. vboxwebsrv) is running under non-root user.

[Youhei Sakurai]

I faced the authentication issue with vboxwebsrv only when I use non-root user to run it although sudoing to root doesn't reproduce the problem.

The root cause seems to be that vboxwebsrv by non-root user failed to read "/etc/pam.d/common-session" when trying to authenticate incoming session thru PAM. It's recorded in /var/log/auth.log on my Debian machine.

The workaround is something like running "usermod -G root vbox" by root user and I think this is not obvious defect onto VirtualBox but documentation should have some description at least - I hope I wouldn't miss it. :) In addition, returning 4xx status code with valid body would be better than 500 causing puzzled error in SDK.

My refferences:

• https://www.virtualbox.org/manual/ch07.html#vbox-auth
• https://www.virtualbox.org/browser/vbox/trunk/src/VBox/HostServices/auth/pam/VBoxAuthPAM.c

Environment:

vbox@WIX:~$ uname -a
Linux WIX 3.2.0-4-amd64 #1 SMP Debian 3.2.51-1 x86_64 GNU/Linux
vbox@WIX:~$ dpkg -l|grep virtualbox-4
ii  virtualbox-4.3                     4.3.6-91406~Debian~wheezy     amd64        Oracle VM VirtualBox

How to run vboxwebsrv:

vbox@WIX:~$ vboxwebsrv -H 0.0.0.0 -v -A VBoxAuth

How to authenticate via SOAP by python:

from vboxapi import VirtualBoxManager
wrapper=VirtualBoxManager("WEBSERVICE", {"user": "vbox", "password": "PASSWORD_OF_VBOX", "url": "http://IP_OF_SERVER:18083/"})

Error message on client:

init exception:  Element "faultstring" missing from complexType
[Element trace: /SOAP-ENV:Envelope/SOAP-ENV:Body/SOAP-ENV:Fault]
Traceback (most recent call last):
  File "vboxapi\__init__.py", line 981, in __init__
    self.vbox = self.platform.getVirtualBox()
  File "vboxapi\__init__.py", line 856, in getVirtualBox
    return self.connect(self.url, self.user, self.password)
  File "vboxapi\__init__.py", line 910, in connect
    self.vbox = self.wsmgr.logon(self.user, self.password)
  File "vboxapi\VirtualBox_wrappers.py", line 11795, in logon
    val=self.mgr.getPort().IWebsessionManager_logon(req)
  File "vboxapi\VirtualBox_client.py", line 9641, in IWebsessionManager_logon
    response = self.binding.Receive(IWebsessionManager_logonResultMsg.typecode)
  File "build\bdist.win32\egg\ZSI\client.py", line 502, in Receive
    return _Binding.Receive(self, replytype, **kw)
  File "build\bdist.win32\egg\ZSI\client.py", line 429, in Receive
    msg = FaultFromFaultMessage(self.ps)
  File "build\bdist.win32\egg\ZSI\fault.py", line 253, in FaultFromFaultMessage
    pyobj = ps.Parse(FaultType.typecode)
  File "build\bdist.win32\egg\ZSI\parse.py", line 323, in Parse
    return how.parse(self.body_root, self)
  File "build\bdist.win32\egg\ZSI\TCcompound.py", line 234, in parse
    '" missing from complexType', ps.Backtrace(elt))
EvaluateException: Element "faultstring" missing from complexType
[Element trace: /SOAP-ENV:Envelope/SOAP-ENV:Body/SOAP-ENV:Fault]

Wireshark's output:

67	20:02:23.934969000	IP_OF_CLIENT	IP_OF_SERVER	HTTP/XML	577	POST / HTTP/1.1
78	20:02:23.940770000	IP_OF_SERVER	IP_OF_CLIENT	HTTP/XML	662	HTTP/1.1 500 Internal Server Error 

Console output on server:

00:00:02.738663 SQW01    external authentication library is 'VBoxAuth'
00:00:02.741213 SQW01    authenticate(): result of AuthEntry(): 0
00:00:02.741455 SQW01    -- leaving __vbox__IWebsessionManager_USCORElogon, rc: 0x80004005

/var/log/auth.log on server:

Jan 14 20:27:50 WIX vboxwebsrv: PAM _pam_load_conf_file: unable to open /etc/pam.d/common-session
Jan 14 20:27:50 WIX vboxwebsrv: PAM error loading (null)
Jan 14 20:27:50 WIX vboxwebsrv: PAM _pam_init_handlers: error reading /etc/pam.d/login
Jan 14 20:27:50 WIX vboxwebsrv: PAM _pam_init_handlers: [Critical error - immediate abort]
Jan 14 20:27:50 WIX vboxwebsrv: PAM error reading PAM configuration file
Jan 14 20:27:50 WIX vboxwebsrv: PAM pam_start: failed to initialize handlers

Permission of /etc/pam.d/common-session:

vbox@WIX:~$ ls -l /etc/pam.d/common-session
-rw-r----- 1 root root 1187 Oct 17 20:44 /etc/pam.d/common-session

[Frank Mehnert]

On Debian 8:

$ ls -l /etc/pam.d/common-session
-rw-r--r-- 1 root root 1295 Feb 12 08:25 /etc/pam.d/common-session

Seems to be a problem with your Linux distribution.