"Authentication required to refresh system repositories" message when connect to my RPi4 with remote desktop

[theandychung]

I recently installed raspberry pi os with desktop directly on my SSD and connect it to my raspberry pi 4.
However, I got this pop up window saying "Authentication required to refresh system repositories" after I installed xrdp and connect to pi4 with remote desktop from my win10 laptop.
I have already tried this three times with only xrdp installed and I always get this message.
The steps I did to install xrdp can be found here.
Can someone help me?

It seems like someone had the same issue here #2000, but it doesn't seems like we have any solution yet.

I have also tried to add a new username and remove "pi", but this pop out window will always stick with the user "pi" as its identity even though I logged in with other username (AND it doesn't let me remove "pi" either).

[matt335672]

Just tried this on a FrankenPi with LXDE.

The issue seems to be that the packagekit service is asking for authentication for the check when you log in.

On my system, sudo journalctl -u packagekit shows this message after logging in over xrdp:-

Jan 10 09:58:19 xrdp-test-lxde PackageKit[1330]: uid 1001 is trying to obtain org.freedesktop.packagekit.system-sources-refresh auth (only_trusted:0)

The org.freedesktop.packagekit.system-sources-refresh string is a PolicyKit action ID. PolicyKit is the system component which decides whether to authorize the action or not.

You can query the response PolicyKit will provide with this command:-

$ pkaction --action-id org.freedesktop.packagekit.system-sources-refresh --verbose
org.freedesktop.packagekit.system-sources-refresh:
  description:       Refresh system repositories
  message:           Authentication is required to refresh the system repositories
  vendor:            The PackageKit Project
  vendor_url:        http://www.packagekit.org/
  icon:              package-x-generic
  implicit any:      auth_admin
  implicit inactive: auth_admin
  implicit active:   yes

The important lines are these:-

• implicit active: yes - this means that PolicyKit alwas allows the action for console logins
• implicit any: auth_admin - this line applies to non-console logins such as xrdp. It specifies that authorization of an admin is required to proceed with the action.

This is a pretty standard configuration. Actions which affect an entire system may be allowed on the console, but prohibited for remote users without additional safeguards.

You can override the system-defined actions if you like. The way this is done depends on your version of PolicyKit:-

• Version 0.105 uses .pkla files to specify overrides. These are .ini files. See pklocalauthority(8) for more info on these.
• Later versions use .rules files to specify overrides. These are Javascript files. See polkit(8) for more info on these.

Your system is Debian-based, so uses .pkla files. This file (/etc/polkit-1/localauthority/50-local.d/xrdp-packagekit.pkla) prevents the prompt for all users in the sudo group:-

[Authorize packagekit updates for remote sessions]
Identity=unix-group:sudo
Action=org.freedesktop.packagekit.system-sources-refresh
ResultAny=yes

This is a relatively simple approach. If you wanted to prevent the prompt for all xrdp users, you could use a group other than sudo, and arrange in some way for all the xrdp users to be in that group.

Your second point about the new user comes down to the auth_admin setting again. Your new user is not in the sudo group, and so polkit tries to find another avenue to obtain authenticate as a privileged user.

Incidentally, a solution to the same issue for a .rules based system is covered in #1889.

[theandychung]

After adding xrdp-packagekit.pkla to /etc/polkit-1/localauthority/50-local.d/ by using nano with root user privilege, I was able to solve this issue. Thank you.

We can close this case if you agree too.

[matt335672]

I've moved this issue to the discussion board, so we'll leave it open for now. There may well be other follow-on questions or suggestions. Glad we sorted it out to your satisfaction.