You are not logged in.
Hello everyone.
It seems that everything I write everywhere in my system (including this post) ends up written as input to /dev/tty1, and read by login --, here I go with the details.
I have had this arch linux setup running for 2 years pretty steadily. My machine is an HP-Envy 17-j00s, I use i3wm and lightdm. Last week I noticed I couldn't open a virtual console. When I press ctrl-alt-fN the screen blinks for less than a second, then everything goes back to the Xorg environment. Also, if I exit I3 (Mod-shift-e) then I can access a virtual console from the lightdm login screen and everything seems to work fine, but I cannot open a virtual console from lightdm if I haven't logged in and closed i3 before.
Yesterday, after suspending the system for the 2nd or 3rd time in a row, every command that required elevation refused to work. poweroff/reboot with setuid flag enabled didn't work, sudo delayed for a while and then terminated with a timeout error, that unfortunately I did not copy.
Reading my journal, I found an alarming amount of messages of failed logons. After reading some of them I noticed the usernames that failed to log in were things I had typed somewhere else:
jun 15 16:43:36 margott login[1813]: FAILED LOGIN 2 FROM tty1 FOR code~, Authentication failure
jun 15 16:43:36 margott login[1813]: pam_tally(login:auth): pam_get_uid; no such user
jun 15 16:43:39 margott login[1813]: pam_unix(login:auth): check pass; user unknown
jun 15 16:43:39 margott login[1813]: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost=Note the 'code~', that is something I typed in this post (the bbcode tag [ code]).
In order to confirm my suspects I opened a terminal and typed
sudo cat /dev/tty1 and started typing in emacs. Everytime I pressed enter in the editor a new line appeared in the terminal.
I also checked that only Xorg and agetty were using tty1:
arch@margott> sudo lsof | grep "/dev/tty1" ~
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
Output information may be incomplete.
Xorg 564 root 10u CHR 4,1 0t0 1042 /dev/tty1
Xorg 564 789 root 10u CHR 4,1 0t0 1042 /dev/tty1
Xorg 564 790 root 10u CHR 4,1 0t0 1042 /dev/tty1
Xorg 564 791 root 10u CHR 4,1 0t0 1042 /dev/tty1
agetty 1665 root 0u CHR 4,1 0t0 1042 /dev/tty1
agetty 1665 root 1u CHR 4,1 0t0 1042 /dev/tty1
agetty 1665 root 2u CHR 4,1 0t0 1042 /dev/tty1The recent changes I am aware of are:
- Installing alternative drivers for my rt3290 network card, from AUR, since the card stopped working in certain cases (I needed to boot windows in order to use it again).
- Installing fprintd and libfprint in an attempt to get my fingerprint reader working (I think this is probably the root of the issue). It seems to be unsopported by current versions.
- Reinstalling bbswitch and nvidia drivers; Recently (since linux4?), the nvidia driver won't load unless I do this every kernel update.
- Updates (who knows...)
I have removed fprintd, libfprint and the new rt3290 driver in a failed attempt to solve the problem.
Any clues what is going on?
Thank you in advance!
Last edited by edmeme (2015-06-15 20:42:17)
Offline
Don't know why this happened, just reinstalled X11 and lighdtm (maybe reinstalling X11 was an overkill), everything seems to work now, but in tty7 instead of 1 as it used to,
It bothers me don't knowing what caused this failure, but I noted that login briefly started before lightdm, both in the same tty, when login should never start if X11 is present.
If anyone has a clue about what caused this I'd still appreciate it.
Offline
I also saw the same problem with stuff I typed showing up in the journal. This is on a Lenovo T430 laptop. It started after the following upgrade:
[2015-07-31 08:06] [PACMAN] Running 'pacman -Sy'
[2015-07-31 08:06] [PACMAN] synchronizing package lists
[2015-07-31 08:06] [PACMAN] Running 'pacman -Su'
[2015-07-31 08:06] [PACMAN] starting full system upgrade
[2015-07-31 08:07] [ALPM] transaction started
[2015-07-31 08:07] [ALPM] upgraded harfbuzz (0.9.41-1 -> 1.0.1-1)
[2015-07-31 08:07] [ALPM] upgraded libdbus (1.8.18-1 -> 1.8.20-1)
[2015-07-31 08:07] [ALPM] upgraded dbus (1.8.18-1 -> 1.8.20-1)
[2015-07-31 08:07] [ALPM] upgraded libsystemd (222-1 -> 223-1)
[2015-07-31 08:07] [ALPM] upgraded systemd (222-1 -> 223-1)
[2015-07-31 08:07] [ALPM] upgraded cairomm (1.10.0-3 -> 1.11.2-1)
[2015-07-31 08:07] [ALPM] upgraded elasticsearch (1.7.0-1 -> 1.7.1-1)
[2015-07-31 08:07] [ALPM] upgraded hicolor-icon-theme (0.13-1 -> 0.15-1)
[2015-07-31 08:07] [ALPM] upgraded libdatrie (0.2.8-1 -> 0.2.9-1)
[2015-07-31 08:07] [ALPM] upgraded libthai (0.1.21-1 -> 0.1.22-1)
[2015-07-31 08:07] [ALPM] upgraded genius (1.0.17-2 -> 1.0.20-1)
[2015-07-31 08:07] [ALPM] upgraded harfbuzz-icu (0.9.41-1 -> 1.0.1-1)
[2015-07-31 08:07] [ALPM] warning: /etc/pacman.d/mirrorlist installed as /etc/pacman.d/mirrorlist.pacnew
[2015-07-31 08:07] [ALPM] upgraded pacman-mirrorlist (20150719-1 -> 20150731-1)
[2015-07-31 08:07] [ALPM] upgraded systemd-sysvcompat (222-1 -> 223-1)
[2015-07-31 08:07] [ALPM] transaction completedThe stuff I typed would show up in the logs as shown below (notice the commands that I typed were "ps -efww | grep rmu" and "systemctl list-jobs" which you can see on the FAILED LOGIN lines):
Jul 31 13:42:26 T430L login[1415]: pam_tally(login:auth): pam_get_uid; no such user
Jul 31 13:42:29 T430L login[1415]: pam_unix(login:auth): check pass; user unknown
Jul 31 13:42:29 T430L login[1415]: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost=
Jul 31 13:42:31 T430L login[1415]: FAILED LOGIN 2 FROM tty1 FOR ps -efww | grep rmu, Authentication failure
Jul 31 13:42:47 T430L login[1415]: pam_tally(login:auth): pam_get_uid; no such user
Jul 31 13:43:04 T430L login[1415]: pam_unix(login:auth): check pass; user unknown
Jul 31 13:43:04 T430L login[1415]: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost=
Jul 31 13:43:05 T430L login[1415]: FAILED LOGIN 3 FROM tty1 FOR systemctl list-jobs, Authentication failureThe truly scary part of this (at least to me) is that this included usernames and passwords that I would type. For example, when I logged back in from xscreensaver or when I typed my username and password into a remote desktop session - all of these also showed up in the journal in the same way as the commands above. I could also type a valid username into a shell session to see that these "random" strings were being checked against real login data (note that the complaints about "user unknown" and "no such user" are gone):
Jul 31 15:49:17 T430L login[3048]: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=tty1 ruser= rhost= user=<user-id-omitted>
Jul 31 15:49:19 T430L login[3048]: FAILED LOGIN 2 FROM tty1 FOR <user-id-omitted>, Authentication failureAnyway, this remains as solved since I was able to fix it by reinstalling lightdm ("pacman -S lightdm") and rebooting.
If anyone would like to know more about this, I have logs and can try to help provide more info.
Last edited by silpertan (2015-08-03 18:32:21)
Offline
same problem here.
tried a pacman -S lightdm but didn't work.
any new findings on how to solve it?
thanks
Offline
After some time, I also noticed that reinstalling lightdm (via pacman) did not always make the problem go away. It seemed that sometimes rebooting would help.
Needless to say, I don't understand the problem. I also don't have the laptop that was having the problem, so I'm unable to investigate it anymore. It isn't even clear to me what bit of the system is at fault (i.e. what is making the connection between keyboard input to any window and the journal). If someone could speculate about that bit, it might help narrow down the culprit. I don't know lightdm intimately, but it's not the first thing I would suspect for a problem like this.
Offline
After having the same problem, I discovered the issue is https://bugs.archlinux.org/task/46799). The fix (setting minimum-vt to 7) has become default in (relatively) recent lightdm release configurations, but needs to be changed in the old ones as I have for some reason modified that setting.
Offline