Unable to set local.passphrase

[osteenbergen]

Describe the bug
System updated to multipass 1.9.0 and now I'm unable to use it as it keeps asking for authentication. Setting authentication results in errors that the client is not authenticated

To Reproduce

$ snap install multipass
$ sudo multipass set local.passphrase
Please enter passphrase: 
Please re-enter passphrase: 
set failed: The client is not authenticated with the Multipass service.
Please use 'multipass authenticate' before proceeding.

I tried to set the passphrase with sudo, as root user and even with snap run --shell multipass.multipassd

Trying to auth with a random password results in:

$ sudo multipass auth
Please enter passphrase: 
authenticate failed: Passphrase is not set. Please `multipass set local.passphrase` with a trusted client.

Expected behavior
I'm expected to have a working multipass client

Logs

mei 05 08:13:12 os-thinkpad multipass.multipassd[2582548]: [debug] [iptables-legacy] [2583517] started: iptables-legacy --wait -t filter --list-rules
mei 05 08:13:12 os-thinkpad multipass.multipassd[2582548]: [debug] [sh] [2583519] started: sh -c iptables-legacy --wait -t filter --delete INPUT -i mpqemubr0 -p tcp -m tcp >
mei 05 08:13:12 os-thinkpad multipass.multipassd[2582548]: [debug] [sh] [2583522] started: sh -c iptables-legacy --wait -t filter --delete INPUT -i mpqemubr0 -p udp -m udp >
mei 05 08:13:12 os-thinkpad multipass.multipassd[2582548]: [debug] [sh] [2583529] started: sh -c iptables-legacy --wait -t filter --delete INPUT -i mpqemubr0 -p udp -m udp >
mei 05 08:13:12 os-thinkpad multipass.multipassd[2582548]: [debug] [sh] [2583537] started: sh -c iptables-legacy --wait -t filter --delete FORWARD -i mpqemubr0 -o mpqemubr0>
mei 05 08:13:12 os-thinkpad multipass.multipassd[2582548]: [debug] [sh] [2583542] started: sh -c iptables-legacy --wait -t filter --delete FORWARD -s 10.223.100.0/24 -i mpq>
mei 05 08:13:12 os-thinkpad multipass.multipassd[2582548]: [debug] [sh] [2583546] started: sh -c iptables-legacy --wait -t filter --delete FORWARD -d 10.223.100.0/24 -o mpq>
mei 05 08:13:12 os-thinkpad multipass.multipassd[2582548]: [debug] [sh] [2583550] started: sh -c iptables-legacy --wait -t filter --delete FORWARD -i mpqemubr0 -m comment ->
mei 05 08:13:12 os-thinkpad multipass.multipassd[2582548]: [debug] [sh] [2583552] started: sh -c iptables-legacy --wait -t filter --delete FORWARD -o mpqemubr0 -m comment ->
mei 05 08:13:12 os-thinkpad multipass.multipassd[2582548]: [debug] [sh] [2583554] started: sh -c iptables-legacy --wait -t filter --delete OUTPUT -o mpqemubr0 -p tcp -m tcp>
mei 05 08:13:12 os-thinkpad multipass.multipassd[2582548]: [debug] [sh] [2583556] started: sh -c iptables-legacy --wait -t filter --delete OUTPUT -o mpqemubr0 -p udp -m udp>
mei 05 08:13:12 os-thinkpad multipass.multipassd[2582548]: [debug] [sh] [2583558] started: sh -c iptables-legacy --wait -t filter --delete OUTPUT -o mpqemubr0 -p udp -m udp>
mei 05 08:13:12 os-thinkpad multipass.multipassd[2582548]: [debug] [iptables-legacy] [2583565] started: iptables-legacy --wait -t nat --list-rules
mei 05 08:13:12 os-thinkpad multipass.multipassd[2582548]: [debug] [sh] [2583566] started: sh -c iptables-legacy --wait -t nat --delete POSTROUTING -s 10.223.100.0/24 ! -d >
mei 05 08:13:12 os-thinkpad multipass.multipassd[2582548]: [debug] [sh] [2583568] started: sh -c iptables-legacy --wait -t nat --delete POSTROUTING -s 10.223.100.0/24 ! -d >
mei 05 08:13:12 os-thinkpad multipass.multipassd[2582548]: [debug] [sh] [2583570] started: sh -c iptables-legacy --wait -t nat --delete POSTROUTING -s 10.223.100.0/24 ! -d >
mei 05 08:13:12 os-thinkpad multipass.multipassd[2582548]: [debug] [sh] [2583572] started: sh -c iptables-legacy --wait -t nat --delete POSTROUTING -s 10.223.100.0/24 -d 25>
mei 05 08:13:12 os-thinkpad multipass.multipassd[2582548]: [debug] [sh] [2583574] started: sh -c iptables-legacy --wait -t nat --delete POSTROUTING -s 10.223.100.0/24 -d 22>
mei 05 08:13:12 os-thinkpad multipass.multipassd[2582548]: [debug] [iptables-legacy] [2583576] started: iptables-legacy --wait -t mangle --list-rules
mei 05 08:13:12 os-thinkpad multipass.multipassd[2582548]: [debug] [sh] [2583577] started: sh -c iptables-legacy --wait -t mangle --delete POSTROUTING -o mpqemubr0 -p udp ->
mei 05 08:13:12 os-thinkpad multipass.multipassd[2582548]: [debug] [iptables-legacy] [2583579] started: iptables-legacy --wait -t raw --list-rules
mei 05 08:13:12 os-thinkpad multipass.multipassd[2582548]: [debug] [dnsmasq] terminating
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]: [info] [dnsmasq] failed to terminate nicely, killing
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]: [trace] [daemon] Removing AppArmor policy:
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]: #include <tunables/global>
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]: profile multipass.dnsmasq flags=(attach_disconnected) {
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   #include <abstractions/base>
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   #include <abstractions/nameservice>
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   capability chown,
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   capability net_bind_service,
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   capability setgid,
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   capability setuid,
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   capability dac_override,
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   capability dac_read_search,
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   capability net_admin,         # for DHCP server
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   capability net_raw,           # for DHCP server ping checks
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   network inet raw,
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   network inet6 raw,
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   # Allow multipassd send dnsmasq signals
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   signal (receive) peer=snap.multipass.multipassd,
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   # access to iface mtu needed for Router Advertisement messages in IPv6
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   # Neighbor Discovery protocol (RFC 2461)
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   @{PROC}/sys/net/ipv6/conf/*/mtu r,
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   # binary and its libs
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   /snap/multipass/6992/usr/sbin/dnsmasq ixr,
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   /snap/multipass/6992/{usr/,}lib/@{multiarch}/{,**/}*.so* rm,
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   # CLASSIC ONLY: need to specify required libs from core snap
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   /{,var/lib/snapd/}snap/core18/*/{,usr/}lib/@{multiarch}/{,**/}*.so* rm,
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   /var/snap/multipass/common/data/multipassd/network/dnsmasq.leases rw,           # Leases file
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   /var/snap/multipass/common/data/multipassd/network/dnsmasq.hosts r,             # Hosts file
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:   /var/snap/multipass/common/data/multipassd/network/dnsmasq-bolTHo.conf r,     # conf file
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]: }
mei 05 08:13:13 os-thinkpad multipass.multipassd[2582548]:     
mei 05 08:13:13 os-thinkpad systemd[1]: snap.multipass.multipassd.service: Succeeded.
mei 05 08:13:13 os-thinkpad systemd[1]: Stopped Service for snap application multipass.multipassd.
mei 05 08:13:21 os-thinkpad systemd[1]: Started Service for snap application multipass.multipassd.
mei 05 08:13:21 os-thinkpad multipassd[2583969]: Unable to determine subnet for the mpqemubr0 subnet
mei 05 08:13:21 os-thinkpad multipassd[2583969]: Using AppArmor support
mei 05 08:13:21 os-thinkpad multipassd[2583969]: Starting dnsmasq
mei 05 08:13:21 os-thinkpad multipassd[2583969]: Applied AppArmor policy: multipass.dnsmasq
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584084] started: dnsmasq --keep-in-foreground --strict-order --bind-interfaces --pid-file --domain=multipass --local=/mul>
mei 05 08:13:21 os-thinkpad dnsmasq[2584084]: started, version 2.80 cachesize 150
mei 05 08:13:21 os-thinkpad dnsmasq[2584084]: compile time options: IPv6 GNU-getopt DBus i18n IDN DHCP DHCPv6 no-Lua TFTP conntrack ipset auth nettlehash DNSSEC loop-detect>
mei 05 08:13:21 os-thinkpad dnsmasq-dhcp[2584084]: DHCP, IP range 10.223.100.2 -- 10.223.100.254, lease time infinite
mei 05 08:13:21 os-thinkpad dnsmasq-dhcp[2584084]: DHCP, sockets bound exclusively to interface mpqemubr0
mei 05 08:13:21 os-thinkpad dnsmasq[2584084]: using local addresses only for domain multipass
mei 05 08:13:21 os-thinkpad dnsmasq[2584084]: reading /etc/resolv.conf
mei 05 08:13:21 os-thinkpad dnsmasq[2584084]: using local addresses only for domain multipass
mei 05 08:13:21 os-thinkpad dnsmasq[2584084]: using nameserver 127.0.0.53#53
mei 05 08:13:21 os-thinkpad dnsmasq[2584084]: read /etc/hosts - 8 addresses
mei 05 08:13:21 os-thinkpad dnsmasq-dhcp[2584084]: read /var/snap/multipass/common/data/multipassd/network/dnsmasq.hosts
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584085] started: iptables-nft --wait -t filter --list-rules
mei 05 08:13:21 os-thinkpad multipassd[2583969]: # Warning: iptables-legacy tables present, use iptables-legacy to see them
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584086] started: iptables-nft --wait -t nat --list-rules
mei 05 08:13:21 os-thinkpad multipassd[2583969]: # Warning: iptables-legacy tables present, use iptables-legacy to see them
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584087] started: iptables-nft --wait -t mangle --list-rules
mei 05 08:13:21 os-thinkpad multipassd[2583969]: # Warning: iptables-legacy tables present, use iptables-legacy to see them
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584088] started: iptables-nft --wait -t raw --list-rules
mei 05 08:13:21 os-thinkpad multipassd[2583969]: # Warning: iptables-legacy tables present, use iptables-legacy to see them
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584089] started: iptables-legacy --wait -t filter --list-rules
mei 05 08:13:21 os-thinkpad multipassd[2583969]: Using iptables-legacy for firewall rules.
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584090] started: iptables-legacy --wait -t filter --list-rules
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584091] started: iptables-legacy --wait -t nat --list-rules
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584092] started: iptables-legacy --wait -t mangle --list-rules
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584093] started: iptables-legacy --wait -t raw --list-rules
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584094] started: iptables-legacy --wait -t filter --insert INPUT --in-interface mpqemubr0 --protocol udp --dport 67 --jum>
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584095] started: iptables-legacy --wait -t filter --insert INPUT --in-interface mpqemubr0 --protocol udp --dport 53 --jum>
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584096] started: iptables-legacy --wait -t filter --insert INPUT --in-interface mpqemubr0 --protocol tcp --dport 53 --jum>
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584097] started: iptables-legacy --wait -t filter --insert OUTPUT --out-interface mpqemubr0 --protocol udp --sport 67 --j>
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584098] started: iptables-legacy --wait -t filter --insert OUTPUT --out-interface mpqemubr0 --protocol udp --sport 53 --j>
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584099] started: iptables-legacy --wait -t filter --insert OUTPUT --out-interface mpqemubr0 --protocol tcp --sport 53 --j>
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584100] started: iptables-legacy --wait -t mangle --insert POSTROUTING --out-interface mpqemubr0 --protocol udp --dport 6>
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584101] started: iptables-legacy --wait -t nat --insert POSTROUTING --source 10.223.100.0/24 --destination 224.0.0.0/24 ->
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584102] started: iptables-legacy --wait -t nat --insert POSTROUTING --source 10.223.100.0/24 --destination 255.255.255.25>
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584103] started: iptables-legacy --wait -t nat --insert POSTROUTING --source 10.223.100.0/24 ! --destination 10.223.100.0>
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584104] started: iptables-legacy --wait -t nat --insert POSTROUTING --source 10.223.100.0/24 ! --destination 10.223.100.0>
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584105] started: iptables-legacy --wait -t nat --insert POSTROUTING --source 10.223.100.0/24 ! --destination 10.223.100.0>
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584106] started: iptables-legacy --wait -t filter --insert FORWARD --destination 10.223.100.0/24 --out-interface mpqemubr>
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584107] started: iptables-legacy --wait -t filter --insert FORWARD --source 10.223.100.0/24 --in-interface mpqemubr0 --ju>
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584108] started: iptables-legacy --wait -t filter --insert FORWARD --in-interface mpqemubr0 --out-interface mpqemubr0 --j>
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584109] started: iptables-legacy --wait -t filter --append FORWARD --in-interface mpqemubr0 --jump REJECT --reject-with i>
mei 05 08:13:21 os-thinkpad multipassd[2583969]: [2584110] started: iptables-legacy --wait -t filter --append FORWARD --out-interface mpqemubr0 --jump REJECT --reject-with >
mei 05 08:13:23 os-thinkpad multipassd[2583969]: gRPC listening on unix:/var/snap/multipass/common/multipass_socket
mei 05 08:13:23 os-thinkpad multipassd[2583969]: QIODevice::write (QFile, "/var/snap/multipass/common/cache/multipassd/vault/multipassd-image-records.json"): device not open
mei 05 08:13:23 os-thinkpad multipassd[2583969]: Starting Multipass 1.9.0
mei 05 08:13:23 os-thinkpad multipassd[2583969]: Daemon arguments: /snap/multipass/6920/bin/multipassd --verbosity debug --logger platform

Additional info

• OS: Ubuntu 20.04
• multipass version: 1.9.0
• multipass info --all: Requires authenticated client, which I'm unable to access

Additional context

ls -l /var/snap/multipass/common/multipass_socket
srw-rw-rw- 1 root root 0 mei  5 08:13 /var/snap/multipass/common/multipass_socket
``

Reinstalling, even with purge didn't resolve the issue.

[townsend2010]

Hi @osteenbergen,

In 1.9, it's not necessary nor recommended to use sudo for such operations. Since your client under your user should already be authenticated with the daemon, then all you need to do is $ multipass set local.passphrase and that should work.

Let me know if this works for you and if so, we'll close this. Thanks!

[osteenbergen]

Under my user I got the same error messages.

I "solved" it by deleting /home/osteenbergen/snap/multipass, however I didn't check if it contained any configuration that caused the conflict.

[townsend2010]

Ok, thanks for letting us know.

Did you happen to have the snap uninstalled, then deleted /home/osteenbergen/snap/andmultipass and then install the snap? I think there is a real problem here and I'm trying to figure out what is going on 🙂

[osteenbergen]

Yes I removed everything before reinstalling the snap

[townsend2010]

Ok, thanks, that explains why it fixed it for you. We are still in the process of how it broke. Glad it's working for you now though.

[lpb313]

Hi,
I have the same problem today after the auto installation of the version of multipass 1.9.0 on my dev server.
For now I solve the problem by installating the 1.8.0 version of multipass :
sudo snap refresh multipass --channel=latest/candidate
Good lock for fix the problem

[townsend2010]

Hi @lpb313,

Would it be possible for you to run the commands I have pointed out at #2554 (comment)? I'm struggling to figure out why this is breaking for some folks.

Thanks!

[lpb313]

Here you have with multipass 1.8.0 running:

• $ tree ~/snap/multipass

/root/snap/multipass
├── 6920
│   ├── config
│   │   └── autostart
│   │       └── multipass.gui.autostart.desktop -> /snap/multipass/6920/usr/share/multipass/multipass.gui.autostart.desktop
│   └── data
│       ├── multipass
│       └── multipass-client-certificate
│           ├── multipass_cert_key.pem
│           └── multipass_cert.pem
├── 6980
│   ├── config
│   │   └── autostart
│   │       └── multipass.gui.autostart.desktop -> /snap/multipass/6980/usr/share/multipass/multipass.gui.autostart.desktop
│   └── data
│       ├── multipass
│       │   └── client-certificate
│       │       ├── multipass_cert_key.pem
│       │       └── multipass_cert.pem
│       └── multipass-client-certificate
│           ├── multipass_cert_key.pem
│           └── multipass_cert.pem
├── common
└── current -> 6980

15 directories, 8 files

• $ find ~/snap/multipass/current/data/ -name multipass_cert.pem -type f | xargs awk 'FNR==1{print FILENAME; }{ print }'

/root/snap/multipass/current/data/multipass-client-certificate/multipass_cert.pem
-----BEGIN CERTIFICATE-----
**Key1**
-----END CERTIFICATE-----
/root/snap/multipass/current/data/multipass/client-certificate/multipass_cert.pem
-----BEGIN CERTIFICATE-----
**Key2**
-----END CERTIFICATE-----

• $ sudo cat /var/snap/multipass/common/data/multipassd/authenticated-certs/multipass_client_certs.pem

-----BEGIN CERTIFICATE-----
**Key3**
-----END CERTIFICATE-----

[townsend2010]

Hey @lpb313,

Thanks for this! I take it the Key1, Key2, and Key3 all indicate that they are unique keys, right?

Also, do you have another user logged into the machine with the multipass.gui running? Is this process running as shown in $ ps -aef | grep multipass.gui and if so, is the user the same as the user you tried running the multipass client with?

I really appreciate the help!

[townsend2010]

Also, since you are running as root, it's possible to manually add root's client certificate to the daemon. Something like (as root):

$ cat ~/snap/multipass/current/data/multipass-client-certificate/multipass_cert.pem  >> /var/snap/multipass/common/data/multipassd/authenticated-certs/multipass_client_certs.pem
$ snap restart multipass

This should work to get 1.9.0 working.

[lpb313]

Yes the 3 keys are unique.

I test with to users, mine and root. Same problems with the both users.

[townsend2010]

Thanks @lpb313,

Could you check the following please:
$ ps -aef | grep multipass.gui