You are not logged in.
Hey guys, hopefully someone has an idea here as it's very odd and I can't find anything similar to this after a while on google (subject = two separate issues by the way, here's the first). I am running arch with all the latest packages, this has been happening for a while now and can't put my finger on. I have pam_tally setup so after 4 failed attempts it locks me out for so long and the KDE screensaver require unlock enabled. Well I'll walk away for 5-10 minutes and come back, type in my password and it does unlock failed, sometimes it flashes it has been locked for failed attempts, either case I hop over to onto a tty and login as root, run pam_tally --user <me> and it shows I have anywhere from 4-18 failed login attempts when there was no failed login attempts...? Even if I just don't move the mouse for 5+ mins and try it will happen sometimes and I have to reset it via pam_tally, like I said one time I was gone for a matter of minutes and came back and when reset it said I had 18 failed attempts =P
Here's all I can think of that even has a maybe chance of contributing to the issue:
- 4x monitors on 1 nvidia keplar card - 4 unlock windows? Lol...
- Yubikey/Yubico challenge response two-factor enabled in pam (works no problem, doesn't matter if I'm removing the key/inserting again or keep it in between trying to login)
Other then that I have no idea, is there anywhere I can find failed login attempts or somewhere I can find information that could point to what's causing this? Secure log shows nothing, services running or not doesn't seem to make a difference (smbd/nmbd/sshd, that's all - generally sshd is off anyway), and I don't see anything under journalctl - so all together have no idea how or why it's happening. The firewall is extremely strict plus often on a closed network and again even with no services it has happened, generally 1-2 times per day seemingly random. And not that old of an install, can't remember - somewhere between maybe few months ago or as far back as june?
While on the note of KDE Screensaver unlock, one other thing that has been happening which is a bit odd is that sometimes (also seemingly random) when I type in my password to unlock the screensaver it unlocks but then leaves all the monitors black and I can only see my mouse (and move it around no problem) for anywhere from 5-30 seconds then the desktop just shows up, this isn't very often but when it happens it can be a bit annoying and have not been able to find much about this same thing happening, maybe nvidia somewhere?
Here's some info:
KDE 4.12.0-1 (happened on 4.11.x as well, maybe as far back as 4.10.x too, not sure exactly)
Kernel 3.12.15-1 default arch for the time being (happened on prior kernels)
Intel Core i7-3820 8core 3.60ghz
16GB RAM
NVIDIA GeForce GTX 660 Ti (nvidia 331.20-2)
Xorg 11.405
1 screen, but each acts independently (no xinerama or base mosiac/anything I BELIEVE - just one nvidia kepler card with 4 outputs plugged in and worked fine default, had to save the xorg conf after arranging them correctly however otherwise would be in wrong order/positions)
Any ideas to either are appreciated, thanks guys!
**edit**
Interesting, apparently I finally checked the journal quick enough after it happened as now I can see the failures in the log, the question is why. I left my computer for 5 minutes, came back tried to login - failed, tried one more time - failed (total of two failures) then hopped onto a tty for root/pam_tally etc... and here's what it's showing:
(leave computer)
Dec 23 08:24:22 cmast dbus[532]: [system] Successfully activated service 'org.kde.powerdevil.backlighthelper'
Dec 23 08:24:22 cmast dbus-daemon[532]: dbus[532]: [system] Successfully activated service 'org.kde.powerdevil.backlighthelper'
Dec 23 08:25:37 cmast dbus-daemon[532]: dbus[532]: [system] Activating service name='org.kde.powerdevil.backlighthelper' (using servicehelper)
Dec 23 08:25:37 cmast dbus[532]: [system] Activating service name='org.kde.powerdevil.backlighthelper' (using servicehelper)
Dec 23 08:25:37 cmast org.kde.powerdevil.backlighthelper[10126]: QDBusConnection: system D-Bus connection created before QCoreApplication. Application may misbehave.
Dec 23 08:25:37 cmast dbus-daemon[532]: dbus[532]: [system] Successfully activated service 'org.kde.powerdevil.backlighthelper'
Dec 23 08:25:37 cmast dbus[532]: [system] Successfully activated service 'org.kde.powerdevil.backlighthelper'
Dec 23 08:34:39 cmast dbus-daemon[532]: dbus[532]: [system] Activating service name='org.kde.powerdevil.backlighthelper' (using servicehelper)
Dec 23 08:34:39 cmast dbus[532]: [system] Activating service name='org.kde.powerdevil.backlighthelper' (using servicehelper)
Dec 23 08:34:39 cmast org.kde.powerdevil.backlighthelper[10193]: QDBusConnection: system D-Bus connection created before QCoreApplication. Application may misbehave.
Dec 23 08:34:39 cmast dbus-daemon[532]: dbus[532]: [system] Successfully activated service 'org.kde.powerdevil.backlighthelper'
Dec 23 08:34:39 cmast dbus[532]: [system] Successfully activated service 'org.kde.powerdevil.backlighthelper'
Dec 23 08:34:47 cmast kcheckpass[10199]: pam_tally(kde:auth): user craig (1000) tally 4, deny 3
Dec 23 08:34:47 cmast kcheckpass[10199]: pam_ecryptfs: pam_sm_authenticate: /home/craig is already mounted
Dec 23 08:34:47 cmast kcheckpass[10197]: pam_ecryptfs: pam_sm_authenticate: /home/craig is already mounted
Dec 23 08:34:47 cmast kcheckpass[10198]: pam_ecryptfs: pam_sm_authenticate: /home/craig is already mounted
Dec 23 08:34:47 cmast kcheckpass[10196]: pam_ecryptfs: pam_sm_authenticate: /home/craig is already mounted
Dec 23 08:34:47 cmast kcheckpass[10196]: USB error: Resource busy
Dec 23 08:34:47 cmast kcheckpass[10198]: USB error: Resource busy
Dec 23 08:34:47 cmast kcheckpass[10196]: Challenge response failed: Device or resource busy
Dec 23 08:34:47 cmast kcheckpass[10198]: Challenge response failed: Device or resource busy
Dec 23 08:34:47 cmast kcheckpass[10197]: USB error: Resource busy
Dec 23 08:34:47 cmast kcheckpass[10197]: Challenge response failed: Device or resource busy
Dec 23 08:34:47 cmast kcheckpass[10196]: Authentication failure for craig (invoked by uid 1000)
Dec 23 08:34:47 cmast kcheckpass[10197]: Authentication failure for craig (invoked by uid 1000)
Dec 23 08:34:47 cmast kcheckpass[10198]: Authentication failure for craig (invoked by uid 1000)
Dec 23 08:34:48 cmast kernel: input: Yubico Yubico Yubikey II as /devices/pci0000:00/0000:00:1d.0/usb4/4-1/4-1.2/4-1.2:1.0/input/input37
Dec 23 08:34:48 cmast kernel: hid-generic 0003:1050:0010.0017: input,hidraw1: USB HID v1.11 Keyboard [Yubico Yubico Yubikey II] on usb-0000:00:1d.0-1.2/input0
Dec 23 08:34:48 cmast kcheckpass[10199]: Authentication failure for craig (invoked by uid 1000)
Dec 23 08:34:54 cmast kcheckpass[10209]: pam_tally(kde:auth): user craig (1000) tally 5, deny 3
Dec 23 08:34:54 cmast kcheckpass[10211]: pam_tally(kde:auth): user craig (1000) tally 6, deny 3
Dec 23 08:34:54 cmast kcheckpass[10210]: pam_tally(kde:auth): user craig (1000) tally 7, deny 3
Dec 23 08:34:54 cmast kcheckpass[10212]: pam_tally(kde:auth): user craig (1000) tally 8, deny 3
Dec 23 08:34:54 cmast kcheckpass[10212]: pam_ecryptfs: pam_sm_authenticate: /home/craig is already mounted
Dec 23 08:34:54 cmast kcheckpass[10211]: pam_ecryptfs: pam_sm_authenticate: /home/craig is already mounted
Dec 23 08:34:54 cmast kcheckpass[10209]: pam_ecryptfs: pam_sm_authenticate: /home/craig is already mounted
Dec 23 08:34:54 cmast kcheckpass[10210]: pam_ecryptfs: pam_sm_authenticate: /home/craig is already mounted
Dec 23 08:34:54 cmast kcheckpass[10209]: USB error: Resource busy
Dec 23 08:34:54 cmast kcheckpass[10209]: Challenge response failed: Device or resource busy
Dec 23 08:34:54 cmast kcheckpass[10210]: USB error: Resource busy
Dec 23 08:34:54 cmast kcheckpass[10210]: Challenge response failed: Device or resource busy
Dec 23 08:34:54 cmast kcheckpass[10211]: USB error: Resource busy
Dec 23 08:34:54 cmast kcheckpass[10211]: Challenge response failed: Device or resource busy
Dec 23 08:34:54 cmast kcheckpass[10209]: Authentication failure for craig (invoked by uid 1000)
Dec 23 08:34:54 cmast kcheckpass[10211]: Authentication failure for craig (invoked by uid 1000)
Dec 23 08:34:54 cmast kcheckpass[10210]: Authentication failure for craig (invoked by uid 1000)
Dec 23 08:34:55 cmast kcheckpass[10212]: Authentication failure for craig (invoked by uid 1000)
Dec 23 08:34:55 cmast kernel: input: Yubico Yubico Yubikey II as /devices/pci0000:00/0000:00:1d.0/usb4/4-1/4-1.2/4-1.2:1.0/input/input38
Dec 23 08:34:55 cmast kernel: hid-generic 0003:1050:0010.0018: input,hidraw1: USB HID v1.11 Keyboard [Yubico Yubico Yubikey II] on usb-0000:00:1d.0-1.2/input0
(moved over to tty to use root to unlock after trying only 2 times (last two times above)
Dec 23 08:35:09 cmast login[7653]: pam_unix(login:session): session opened for user root by LOGIN(uid=0)
Dec 23 08:35:09 cmast kernel: input: Yubico Yubico Yubikey II as /devices/pci0000:00/0000:00:1d.0/usb4/4-1/4-1.2/4-1.2:1.0/input/input39
Dec 23 08:35:09 cmast kernel: hid-generic 0003:1050:0010.0019: input,hidraw1: USB HID v1.11 Keyboard [Yubico Yubico Yubikey II] on usb-0000:00:1d.0-1.2/input0
Dec 23 08:35:09 cmast systemd[1]: Starting user-0.slice.
Dec 23 08:35:09 cmast systemd[1]: Created slice user-0.slice.
Dec 23 08:35:09 cmast systemd[1]: Starting User Manager for 0...
Dec 23 08:35:09 cmast systemd[1]: Starting Session 7 of user root.
Dec 23 08:35:09 cmast systemd-logind[523]: New session 7 of user root.
Dec 23 08:35:09 cmast systemd[1]: Started Session 7 of user root.
Dec 23 08:35:09 cmast systemd[10225]: pam_unix(systemd-user:session): session opened for user root by (uid=0)SO it would seem like ecryptfs keeps trying to unlock my home directory whenever I walk away? Why would it do that? Not sure why the USB is throwing errors (left it in there, but never has issues when I'm using/needing it so think that's coming from the ecryptfs issue or something?) My home folder is not even the ecryptfs directory, its ~/Private/ which I setup using the automated script and auto-mount via pam/following arch wiki. Any ideas? Seems like pam_ecryptfs is trying to mount my home dir 4 times randomly when my screensaver is on which instantly locks me out? Thanks guys
PS - /etc/pam.d/system-auth
#%PAM-1.0
auth required pam_unix.so try_first_pass nullok
#ecryptfs user mount
auth required pam_ecryptfs.so unwrap
auth optional pam_permit.so
auth required pam_env.so
#yubikey
auth required pam_yubico.so mode=challenge-response chalresp_path=/etc/yubico
account required pam_unix.so
account optional pam_permit.so
account required pam_time.so
#ecryptfs user mount
password optional pam_ecryptfs.so
password required pam_unix.so try_first_pass nullok sha512 shadow
password optional pam_permit.so
session required pam_limits.so
session required pam_unix.so
#ecryptfs user mount
session optional pam_ecryptfs.so
session optional pam_permit.soLast edited by Hazey (2013-12-23 17:47:25)
Offline