# Desktop client doesn't handle expired password prompt

**URL:** <https://community.thinlinc.com/t/desktop-client-doesnt-handle-expired-password-prompt/838>\
**Category:** Community Support\
**Tags:** tlclient\
**Created:** [31 January 2024 12:02 UTC](https://community.thinlinc.com/t/desktop-client-doesnt-handle-expired-password-prompt/838 "2024-01-31T12:02:31Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![astroowen](https://avatars.discourse-cdn.com/v4/letter/a/838e76/32.png) [@astroowen](https://community.thinlinc.com/u/astroowen)\
**Post date:** [31 January 2024 12:02 UTC](https://community.thinlinc.com/t/desktop-client-doesnt-handle-expired-password-prompt/838/1 "2024-01-31T12:02:32Z")

</div>

If a Linux user’s password is expired (with `passwd -e`) trying to log in with the desktop client fails.

Logging in with the correct password (server 4.12.1) shows a dialog saying “You are required to change your password immediately (administrator enforced)” which must be the challenge from PAM, but subsequent challenges are not shown. Instead the error “ThinLinc login failed (The SSH connection succeeded, but the ThinLinc server connection failed. Perhaps this server doesn’t run a ThinLinc server?)” is shown. There’s no useful feedback about where exactly this fails in the journal nor vsmserver/vsmagent logs but I suppose the challenge is just rejected when the dialog is closed and then the session is closed before the connection is established.

The web access client handles this correctly, by contrast: after entering the old username and password, the same PAM challenge is shown, but it’s followed by the subsequent challenges which ask for and accept the new password. (This is mentioned as being fixed in [5028 – Web Access authentication does not handle expired password pam prompts (cendio.com)](https://bugzilla.cendio.com/show_bug.cgi?id=5028).)

Is there a way to get the same behaviour as the web access client on the desktop client?

---

<div class="post-metadata">

**Author:** ![martin](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/martin/32/41_2.png) [@martin](https://community.thinlinc.com/u/martin)\
**Post date:** [31 January 2024 12:29 UTC](https://community.thinlinc.com/t/desktop-client-doesnt-handle-expired-password-prompt/838/2 "2024-01-31T12:29:50Z")

</div>

Hello @astroowen

What Distribution/version is this ThinLinc 4.12.1 server running on?

Kind regards,  
Martin

---

<div class="post-metadata">

**Author:** ![astroowen](https://avatars.discourse-cdn.com/v4/letter/a/838e76/32.png) [@astroowen](https://community.thinlinc.com/u/astroowen)\
**Post date:** [31 January 2024 12:43 UTC](https://community.thinlinc.com/t/desktop-client-doesnt-handle-expired-password-prompt/838/3 "2024-01-31T12:43:42Z")

</div>

That server runs on Ubuntu 23.04, though I have also encountered this on SL 7 servers.

---

<div class="post-metadata">

**Author:** ![martin](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/martin/32/41_2.png) [@martin](https://community.thinlinc.com/u/martin)\
**Post date:** [31 January 2024 13:55 UTC](https://community.thinlinc.com/t/desktop-client-doesnt-handle-expired-password-prompt/838/4 "2024-01-31T13:55:31Z")

</div>

Sorry for sidetracking a bit here, but, are you really running ThinLinc 4.12.1? That version of ThinLinc requires python2, and Ubuntu 23.04 has no Python2?

Regards,  
Martin

---

<div class="post-metadata">

**Author:** ![martin](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/martin/32/41_2.png) [@martin](https://community.thinlinc.com/u/martin)\
**Post date:** [31 January 2024 14:37 UTC](https://community.thinlinc.com/t/desktop-client-doesnt-handle-expired-password-prompt/838/5 "2024-01-31T14:37:50Z")

</div>

For ThinLinc (native) client to pick up these prompts from PAM, you’d need to set ` KbdInteractiveAuthentication yes` in your sshd configuration.

Kind regards,  
Martin

---

<div class="post-metadata">

**Author:** ![astroowen](https://avatars.discourse-cdn.com/v4/letter/a/838e76/32.png) [@astroowen](https://community.thinlinc.com/u/astroowen)\
**Post date:** [2 February 2024 09:31 UTC](https://community.thinlinc.com/t/desktop-client-doesnt-handle-expired-password-prompt/838/6 "2024-02-02T09:31:50Z")

</div>

I set that option to yes (and verified it was set, and restarted sshd) with the same result: the client shows the first “you are required to change your password immediately” prompt but no further prompts.

(`/opt/thinlinc/etc/thinlinc-release` and the web access client, both report it’s ThinLinc 4.12.1… the OS was upgraded from an older Ubuntu but it still has python2 on it.)

---

<div class="post-metadata">

**Author:** ![martin](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/martin/32/41_2.png) [@martin](https://community.thinlinc.com/u/martin)\
**Post date:** [2 February 2024 11:55 UTC](https://community.thinlinc.com/t/desktop-client-doesnt-handle-expired-password-prompt/838/7 "2024-02-02T11:55:41Z")

</div>

Ok.

Could you share the tlclient.log from when this is happening, and also the output of  
` sudo sshd -T | grep kbd`

Btw, 4.12.1 will be out of support really soon, 2024-02-05.

Regards,  
Martin

---

<div class="post-metadata">

**Author:** ![astroowen](https://avatars.discourse-cdn.com/v4/letter/a/838e76/32.png) [@astroowen](https://community.thinlinc.com/u/astroowen)\
**Post date:** [2 February 2024 12:30 UTC](https://community.thinlinc.com/t/desktop-client-doesnt-handle-expired-password-prompt/838/8 "2024-02-02T12:30:00Z")

</div>

I’d already done `sshd -T`. Here is my local tlclient.log (lightly redacted):

```auto
2024-02-02T13:13:24: Log file created for ThinLinc client running on process 3664
2024-02-02T13:13:24: ThinLinc client release 4.15.0 build 3258
2024-02-02T13:13:37: SSH command: "C:\Program Files\ThinLinc Client\ssh.exe" -N -o GlobalKnownHostsFile=nul -o UserKnownHostsFile=nul -o UpdateHostKeys=yes -o PasswordAuthentication=no -o ChallengeResponseAuthentication=no -o KbdInteractiveAuthentication=no -o IdentityFile=\"C:\Users\user\.ssh\id_rsa\" -o CheckHostIP=no -o NumberOfPasswordPrompts=3 -o HostKeyAlgorithms=<ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-ed25519,ecdsa-sha2-nistp256 user@host -p 22 thinlinc-login master
2024-02-02T13:13:37: ssh[E]: CONFIRM HOST KEY: 
2024-02-02T13:13:37: Host key previously known.
2024-02-02T13:13:37: ssh[E]: NEXT AUTHMETHOD: none
2024-02-02T13:13:37: ssh[E]: AUTH FAILURE
2024-02-02T13:13:37: ssh[E]: NEXT AUTHMETHOD: publickey
2024-02-02T13:13:37: ssh[E]: BANNER: You are required to change your password immediately (administrator enforced).\n
2024-02-02T13:13:39: ssh[E]: AUTH SUCCESS
2024-02-02T13:13:39: ssh[E]: CONNECTED
2024-02-02T13:13:39: ssh[E]: UPDATE HOST KEYS: 3 host ip 22
2024-02-02T13:13:39: Updating host keys for host.
2024-02-02T13:13:39: ssh[E]: WARNING: Your password has expired.
2024-02-02T13:13:39: ssh[E]: Password change required but no TTY available.
2024-02-02T13:13:39: ssh[E]: 
2024-02-02T13:13:39: ssh[E]: COMMAND_EXITSTATUS: 1
2024-02-02T13:13:39: WinProcess: Process 6020 (ssh.exe) did not exit in a timely manner. Forcing termination...
2024-02-02T13:13:45: Cannot find monitor for entry: 
2024-02-02T13:13:57: SSH command: "C:\Program Files\ThinLinc Client\ssh.exe" -N -o GlobalKnownHostsFile=nul -o UserKnownHostsFile=nul -o UpdateHostKeys=yes -o PubkeyAuthentication=no -o CheckHostIP=no -o NumberOfPasswordPrompts=1 -o HostKeyAlgorithms=<ssh-rsa,rsa-sha2-256,rsa-sha2-512,ssh-ed25519,ecdsa-sha2-nistp256 user@host -p 22 thinlinc-login master
2024-02-02T13:13:57: ssh[E]: CONFIRM HOST KEY:
2024-02-02T13:13:57: Host key previously known.
2024-02-02T13:13:57: ssh[E]: NEXT AUTHMETHOD: none
2024-02-02T13:13:57: ssh[E]: AUTH FAILURE
2024-02-02T13:13:57: ssh[E]: NEXT AUTHMETHOD: keyboard-interactive
2024-02-02T13:13:57: ssh[E]: SSH_PROMPT:(user@host) Password: 
2024-02-02T13:13:58: ssh[E]: SSH_PROMPT:(user@host) You are required to change your password immediately (administrator enforced).Changing password for user.Current password: 
2024-02-02T13:23:12: ssh[E]: SSH_PROMPT:(user@host) New password: 
2024-02-02T13:23:26: ssh[E]: SSH_PROMPT:(user@host) Retype new password: 
2024-02-02T13:23:27: ssh[E]: AUTH SUCCESS
2024-02-02T13:23:27: ssh[E]: CONNECTED
...

```

When checking the tlclient.log file from the last session, I immediately noticed the `-o ChallengeResponseAuthentication=no -o KbdInteractiveAuthentication=no` in the SSH command, so I tried again once with my private key and once with my password. (I had tried password auth already but not since setting `KbdInteractiveAuthentication yes` on the server.) You can see that those options aren’t present in the command where I used password auth, and sure enough the client delivered the further prompts and let me change my password!

So thanks for pointing me in the right direction - `KbdInteractiveAuthentication yes` needs to be allowed on both server _and_ client.

Do you expect that it will be possible to show the expired password prompt when logging in with a private key, or is it necessary for the client to set `-o KbdInteractiveAuthentication=no` in the private key auth case? Or perhaps to give a more informative error (for example telling the user to try logging in with their password if it exists)?

---

<div class="post-metadata">

**Author:** ![martin](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/martin/32/41_2.png) [@martin](https://community.thinlinc.com/u/martin)\
**Post date:** [2 February 2024 12:53 UTC](https://community.thinlinc.com/t/desktop-client-doesnt-handle-expired-password-prompt/838/9 "2024-02-02T12:53:34Z")

</div>

Hi,

For changing password, the user need using password authentication, which will enable Keyboard-interactive. This is not possible to change with the ThinLinc client if using some other method of authenticating.

I’m not aware of an easy way of notifying the user if their password has expired when they are using Publick Key authentication.

Kind regards,  
Martin