Arch Linux

medicineman2500

Member

Registered: 2021-10-07

Posts: 66

[SOLVED] Random password issues sudo

There appear to be two situations where sudo is having password issues, or password issues are happening somewhere:

1. When I enter the wrong password repeatedly (without any such policy applied to the system)

2. When it seemingly feels like it

This issue is intermittent and thus hard to reproduce. Anyone else having similar problems and/or know how to trace the problem?

Last edited by medicineman2500 (2022-01-21 15:09:01)

Scimmia

Fellow

Registered: 2012-09-01

Posts: 11,553

Re: [SOLVED] Random password issues sudo

You'll want to look into pam_faillock.

medicineman2500

Member

Registered: 2021-10-07

Posts: 66

Re: [SOLVED] Random password issues sudo

You'll want to look into pam_faillock.

Is that the one which sets lockout policies on failed attempts? Because I haven't set that up and from memory by default it's not activated.

I should also mention that even after switching user to root and resetting my users password, I still cannot use it until I do a full reboot.

seth

Member

Registered: 2012-09-03

Posts: 51,149

Re: [SOLVED] Random password issues sudo

Check the output of "faillock" and whether you're banned.

"faillock --reset" will open the module again and it *is* active by default:
https://wiki.archlinux.org/title/Securi … n_attempts

As of pambase 20200721.1-2, pam_faillock.so is enabled by default to lock out users for 10 minutes after 3 failed login attempts in a 15 minute period (see FS#67644). The lockout only applies to password authentication (e.g. login and sudo), public key authentication over SSH is still accepted. To prevent complete denial-of-service, this lockout is disabled on root.

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc

medicineman2500

Member

Registered: 2021-10-07

Posts: 66

Re: [SOLVED] Random password issues sudo

Check the output of "faillock" and whether you're banned.

"faillock --reset" will open the module again and it *is* active by default:
https://wiki.archlinux.org/title/Securi … n_attempts

As of pambase 20200721.1-2, pam_faillock.so is enabled by default to lock out users for 10 minutes after 3 failed login attempts in a 15 minute period (see FS#67644). The lockout only applies to password authentication (e.g. login and sudo), public key authentication over SSH is still accepted. To prevent complete denial-of-service, this lockout is disabled on root.

Ah ... "20200721" so only a change that happened just over 16 months ago no biggie haha

Tbh it's probably this and I'm imagining things. Solved.

Last edited by medicineman2500 (2022-01-21 15:09:31)