Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Can't login via GUI, but can login on console

Backstory: I restored a Time Machine backup of my laptop onto my new iMac and everything has been working great until today. A long time ago I connected my laptop to an Active Directory domain. Once I restored the image to my iMac, I changed the computer name in Network Preferences. This had not caused any problems.

Today I was going through the Account Preferences screen and noticed the Login Options had "Allow network users to login" checked, and it listed Active Directory as a user source. I thought "wow, that must allow AD users to login to my machine with their credentials, I sure don't want that!" so I unchecked it. Then I got spinning beachball of death and I couldn't click on anything. I decided to take a nap and hope that it would resolve itself, but an hour later it was still spinning.

I put the iMac to sleep with the Power button and then woke it back up. A dialog flashed on the screen that said "to access this computer you must login" or something like that. It had my account named filled out already, so I typed in my password, hit enter, and the status said "checking password." It stayed like that indefinitely, while nothing else responded (not even ctrl optesc or ctrl opteject or any of those key combos).

I turned the machine off and turned it back on again, but when I entered my password it waiting for about 5 seconds, then just displayed the login window again.

I typed '>console' in for the username and hit enter, to get to the console login screen. From there I proceeded to login with my username and password, no problem! I used 'passwd' and 'dscl' to reset my password, both of which worked w/o problem. I can do 'dscl . authonly <myusername> <mypassword>' and it doesn't give an error. Despite that, I still couldn't login via the Login Window.

I tried moving the /Library/Preferences/DirectoryServices folder and killing the DirectoryServices daemon so it would restart. That resulted in my password being instantly rejected with no pause when trying to login.

I've also booted from the DVD to reset my password through the utility, repair my home permissions & ACLs, and used the Disk Utility to Repair Permissions on the drive. No use.

I'm really at a loss for what to do now. All my Google searches lead me to instructions for how to join Active Directory from the command line, but I don't want to do that. It doesn't look like it's trying to authenticate to AD any more any way, because the ActiveDirectory plist didn't get recreated.

Help?

iMac 27" Core i7, Mac OS X (10.6.6), iPhone 4 32GB

Posted on Feb 2, 2011 8:15 PM

Reply
8 replies

Feb 3, 2011 12:41 AM in response to Brian Keefer

More things that did not work:
Trash /etc/krb5.keytab
Trash /var/db/dslocal/nodes/Default/config/Kerberos:<domain>.plist
Trash all the .plist files I could find in /Library/Preferences that had anything to do with networking and/or authentication
The one that I really thought would work: replace /etc/authorization with the one from install DVD

I guess I have to wait until morning to call AppleCare, but I have a feeling this is so complex they'll probably tell me to reinstall or bring it into a store... SIIIIIIIIIIIIIIIIGH.

Oh yeah, I also tried doing a reverse ssh tunnel by doing:
launchctl load -F /opt/local/etc/LaunchDaemons/org.macports.OpenSSH/org.macports.OpenSSH.plist
ssh -R <local port>:127.0.0.1:<remote port>
and then from that remote host doing
ssh -p <remote port> <user>@localhost

This forwards a port from localhost on a remote machine to localhost on the iMac, where it connects to OpenSSH running on the iMac--I couldn't get packets through the firewall inbound, even though I inserted a rule for it with ipfw add. I could get an authentication prompt for password via ssh, so I know the tunnel worked, but it wouldn't accept the password. That's pretty strange since I can login on the console with the password.

I really would have expected replacing /etc/authorization to work (it did for a user in http://discussions.apple.com/thread.jspa?threadID=1707996), but alas. It's now 7 hours since my machine locked me out and I'm dead tired.

It really should not be possible to so brutally lock-out users simply by un-ticking a checkbox in Preferences, especially when it looks like that checkbox is compromising your security by being on.

Feb 3, 2011 1:54 PM in response to Brian Keefer

I finally figured it out: When I removed (via Account Preferences) the ability for Network Users to login, it created a com.apple.access_loginwindow group, but with no members. This effectively blocked ANY user from being able to login through the Login Window, although fortunately I could still login from the command line (console).

I used the 'id' command to see that my user was in the localaccounts group, so I tried adding localaccounts group to com.apple.access_loginwindow:
dseditgroup -o edit -a localaccounts -T group com.apple.access_loginwindow

I could use dscl to read the contents of the com.apple.access_loginwindow group and see that localaccounts was a nested group member, so technically that should have allowed access, but it didn't.

Then I noticed that my laptop doesn't even have com.apple.access_loginwindow, which made me suspect if it was missing, I could login.
dseditgroup -o delete -T group com.apple.access_loginwindow

Now when I exited console and went to the Login Window, I saw a list of users to choose from (before it was just the username & password box), ahh, we're getting somewhere! I clicked on my user, typed the password, and... BAM! Access 🙂

I'm going to be filing a bug for this shortly as obviously an empty group shouldn't be created that then effectively blocks all login access.

Can't login via GUI, but can login on console

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.