[SOLVED] Can't login PAM issue

webcapcha · 2020-08-28 15:38:54

Guys I've gone through all comments on

Apparent bug in faillock: https://bugs.archlinux.org/task/67644
Removed tally module referenced: https://bugs.archlinux.org/task/67641
.pam_environment parsing: https://bugs.archlinux.org/task/67636

but without lucky.

grep tally /etc/pam.d/*
grep tally2 /etc/pam.d/*
grep pam_cracklib /etc/pam.d/*

gives me no result

Here is my current

system-auth:
#%PAM-1.0

auth       required                    pam_faillock.so      preauth
# Optionally use requisite above if you do not want to prompt for the password
# on locked accounts.
auth       [success=2 default=ignore]  pam_unix.so          try_first_pass nullok
-auth      [success=1 default=ignore]  pam_systemd_home.so
auth       [default=die]               pam_faillock.so      authfail
auth       optional                    pam_permit.so
auth       required                    pam_env.so
auth       required                    pam_faillock.so      authsucc
# If you drop the above call to pam_faillock.so the lock will be done also
# on non-consecutive authentication failures.

-account   [success=1 default=ignore]  pam_systemd_home.so
account    required                    pam_unix.so
account    optional                    pam_permit.so
account    required                    pam_time.so

-password  [success=1 default=ignore]  pam_systemd_home.so
password   required                    pam_unix.so          try_first_pass nullok shadow
password   optional                    pam_permit.so

session    required                    pam_limits.so
session    required                    pam_unix.so
session    optional                    pam_permit.so

system-login

#%PAM-1.0

auth       required   pam_shells.so
auth       requisite  pam_nologin.so
auth       include    system-auth

account    required   pam_access.so
account    required   pam_nologin.so
account    include    system-auth

password   include    system-auth

session    optional   pam_loginuid.so
session    optional   pam_keyinit.so       force revoke
session    include    system-auth
session    optional   pam_motd.so          motd=/etc/motd
session    optional   pam_mail.so          dir=/var/spool/mail standard quiet
-session   optional   pam_systemd.so
session    required   pam_env.so           user_readenv=1

systemd-user

# Used by systemd --user instances.

account  include system-login
session  required pam_loginuid.so
session  include system-login

When I trying to login either with regular user or root I've got a message "Login incorrect"

Last edited by webcapcha (2020-08-28 20:12:49)

loqs · 2020-08-28 18:31:45

What is in the journal when a login is rejected? Any .pacnew files in /etc/pam.d?

webcapcha · 2020-08-28 18:34:05

loqs wrote:

What is in the journal when a login is rejected? Any .pacnew files in /etc/pam.d?

no pacnew files

total 160
drwxr-xr-x  2 root root 4096 Aug 28 15:57 .
drwxr-xr-x 97 root root 4096 Aug 28 17:57 ..
-rw-r--r--  1 root root  160 Jul 15 20:15 chage
-rw-r--r--  1 root root  160 Aug 20 08:11 chfn
-rw-r--r--  1 root root  103 Jul 15 20:15 chgpasswd
-rw-r--r--  1 root root  174 Jul 15 20:15 chpasswd
-rw-r--r--  1 root root  160 Aug 20 08:11 chsh
-rw-r--r--  1 root root  281 Oct 31  2019 crond
-rw-r--r--  1 root root  160 Jul 15 20:15 groupadd
-rw-r--r--  1 root root  160 Jul 15 20:15 groupdel
-rw-r--r--  1 root root  103 Jul 15 20:15 groupmems
-rw-r--r--  1 root root  160 Jul 15 20:15 groupmod
-rw-r--r--  1 root root  194 Aug  5 12:02 kde
-rw-r--r--  1 root root  220 Aug 20 08:11 login
-rw-r--r--  1 root root  174 Jul 15 20:15 newusers
-rw-r--r--  1 root root  274 Aug 12 19:34 other
-rw-r--r--  1 root root  118 Aug 28 15:21 passwd
-rw-r--r--  1 root root  198 Aug 28 15:21 passwd.BACKUP
-rw-r--r--  1 root root  155 Aug  3 07:49 polkit-1
-rw-r--r--  1 root root   76 Aug 20 08:11 runuser
-rw-r--r--  1 root root   76 Aug 20 08:11 runuser-l
-rw-r--r--  1 root root  402 Aug 14 12:43 sddm
-rw-r--r--  1 root root  529 Aug 14 12:43 sddm-autologin
-rw-r--r--  1 root root  397 Aug 14 12:43 sddm-greeter
-rw-r--r--  1 root root  160 Jul 15 20:15 shadow
-rw-r--r--  1 root root  232 Jul 16 20:16 sshd
-rw-r--r--  1 root root  366 Aug 20 08:11 su
-rw-r--r--  1 root root   97 Jul 22 14:15 sudo
-rw-r--r--  1 root root  366 Aug 20 08:11 su-l
-rw-r--r--  1 root root 1258 Aug 12 19:34 system-auth
-rw-r--r--  1 root root  131 Aug 20 08:18 systemd-user
-rw-r--r--  1 root root  143 Aug 12 19:34 system-local-login
-rw-r--r--  1 root root  696 Aug 28 18:12 system-login
-rw-r--r--  1 root root  621 Aug 28 15:57 system-login.BACKUP
-rw-r--r--  1 root root  143 Aug 12 19:34 system-remote-login
-rw-r--r--  1 root root  260 Aug 12 19:34 system-services
-rw-r--r--  1 root root  160 Jul 15 20:15 useradd
-rw-r--r--  1 root root  160 Jul 15 20:15 userdel
-rw-r--r--  1 root root  160 Jul 15 20:15 usermod
-rw-r--r--  1 root root  124 Aug 14 12:24 vlock

webcapcha · 2020-08-28 18:36:06

regarding journal, well how I can grab logs during login?
Only one idea come up to me, is to chroot. Correct?

loqs · 2020-08-28 18:38:08

If you cannot login then yes live media then chroot in.

webcapcha · 2020-08-28 18:47:32

loqs wrote:

If you cannot login then yes live media then chroot in.

I'm not advance with chroot (looks like I need previous boot, coorect? because current boot is live cd), here is journalctl -b -1

https://hastebin.com/okatatazeh.coffeescript

Last edited by webcapcha (2020-08-28 18:49:15)

loqs · 2020-08-28 19:20:58

Aug 28 20:57:53 home-desktop login[895]: pam_faillock(login:auth): Consecutive login failures for user lex account temporarily locked

The account was locked for three password failures by faillock. I think the three failures were attempts logging in using SDDM.
Can you try logging in using the tty first, if that fails the journal might provide more information.

Last edited by loqs (2020-08-28 19:21:13)

webcapcha · 2020-08-28 19:24:17

loqs wrote:

Aug 28 20:57:53 home-desktop login[895]: pam_faillock(login:auth): Consecutive login failures for user lex account temporarily locked
The account was locked for three password failures by faillock. I think the three failures were attempts logging in using SDDM.
Can you try logging in using the tty first, if that fails the journal might provide more information.

I always tried to login with tty too. With no luck. And as far as i know locked account should be visible in /var/run/faillock.

loqs · 2020-08-28 19:30:55

You should have a file in /run/faillock for every login processed by pam_faillock. The file will be empty if there have been no failed logins.
You can reset the faillock with.

# faillock --user username --reset

Possibly https://bugs.archlinux.org/task/67644 although there is no explanation as to how pam_faillock causes the issues.

webcapcha · 2020-08-28 19:36:21

loqs wrote:

You should have a file in /run/faillock for every login processed by pam_faillock. The file will be empty if there have been no failed logins.
You can reset the faillock with.
# faillock --user username --reset
Possibly https://bugs.archlinux.org/task/67644 although there is no explanation as to how pam_faillock causes the issues.

I've just 1 min ago reboot into regular arch tried to login at first with tty, not even tried sddm and as usually got "login incorrect"

here are logs (they are small)

https://hastebin.com/tikuhetewu.coffeescript

Last edited by webcapcha (2020-08-28 19:37:53)

loqs · 2020-08-28 19:43:28

The output points to a bad password.
What it you chroot in, change the password or create a new user with a new password. Also try booting to multi-user.target for the test so SDDM is not started.

webcapcha · 2020-08-28 19:47:24

loqs wrote:

The output points to a bad password.
What it you chroot in, change the password or create a new user with a new password. Also try booting to multi-user.target for the test so SDDM is not started.

my password just numbers, not letters, not uppercase, no special symbols. It just can't be wrong password

loqs · 2020-08-28 19:51:55

Aug 28 22:28:00 home-desktop login[889]: FAILED LOGIN SESSION FROM tty3 FOR lex, Permission denied

Is all I can see for the tty3 login failure. The pam related messages in the journal are all seem to be from sddm.
Edit:
Journal output for a login of a passwd based user on this system:

systemd[1]: Started Getty on tty2.
dbus-daemon[402]: [system] Activating via systemd: service name='org.freedesktop.home1' unit='dbus-org.freedesktop.home1.service' requested by ':1.203' (uid=0 pid=3176 comm="/bin/login -p --          ")
dbus-daemon[402]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.home1.service': Unit dbus-org.freedesktop.home1.service not found.
login[3176]: pam_systemd_home(login:account): Failed to query user record: Unit dbus-org.freedesktop.home1.service not found.
dbus-daemon[402]: [system] Activating via systemd: service name='org.freedesktop.home1' unit='dbus-org.freedesktop.home1.service' requested by ':1.203' (uid=0 pid=3176 comm="/bin/login -p --          ")
dbus-daemon[402]: [system] Activation via systemd failed for unit 'dbus-org.freedesktop.home1.service': Unit dbus-org.freedesktop.home1.service not found.
login[3176]: pam_systemd_home(login:session): Failed to query user record: Unit dbus-org.freedesktop.home1.service not found.
login[3176]: pam_unix(login:session): session opened for user testuser(uid=1001) by LOGIN(uid=0)

Last edited by loqs (2020-08-28 20:01:59)

webcapcha · 2020-08-28 19:59:57

loqs wrote:

Aug 28 22:28:00 home-desktop login[889]: FAILED LOGIN SESSION FROM tty3 FOR lex, Permission denied
Is all I can see for the tty3 login failure. The pam related messages in the journal are all seem to be from sddm.

what the crap. I've changed the pass for my regular user and I am able to login from tty as well as to plasma.

How it could be? There is no way that I forgot my pass. Believe me it is very ease. Just numbers! Even arch I've been using for 2 years. And ALL time I am using the same password. What the hell?

I have no idea...... Do you have one?

Anyway thanks a lot. Because otherwise I was going to reinstall arch tomorrow

seth · 2020-08-28 20:00:25

a) did you check that the number keys genereate the expected input?
b) /etc/shadow might have been hit (eg. overwritten by some .pacnew)
c) did you set "deny = 0" in /etc/security/faillock.conf ?

Edit: crap

Last edited by seth (2020-08-28 20:01:09)

webcapcha · 2020-08-28 20:01:06

P.S before changing the pass, I've tried to unlock my username and it didn't help

webcapcha · 2020-08-28 20:09:42

seth wrote:

b) /etc/shadow might have been hit (eg. overwritten by some .pacnew)

You are genius. Yes. I've checked last file modification date and it's TODAY. I had a bunch of pacnew files today and might be mistakenly override /etc/shadow. Oh my god, I'm so stupid.....

So, next step, I need to restore my root user. I have two user here, root and regular user. Regular now is working. Just change pass for root and that's all? Please help because after 4 hours my brain is gone completely

seth · 2020-08-28 20:11:07

It is today for sure since you just changed the password - it's however still the most likely explanation.

Edit:
Please always remember to mark resolved threads by editing your initial posts subject - so others will know that there's no task left, but maybe a solution to find.
Thanks.

Last edited by seth (2020-08-28 20:11:27)

webcapcha · 2020-08-28 20:16:36

loqs wrote:

The output points to a bad password.
What it you chroot in, change the password or create a new user with a new password. Also try booting to multi-user.target for the test so SDDM is not started.

thanks a lot for pointed me out to the solution.

Arch Linux

#1 2020-08-28 15:38:54

[SOLVED] Can't login PAM issue

#2 2020-08-28 18:31:45

Re: [SOLVED] Can't login PAM issue

#3 2020-08-28 18:34:05

Re: [SOLVED] Can't login PAM issue

#4 2020-08-28 18:36:06

Re: [SOLVED] Can't login PAM issue

#5 2020-08-28 18:38:08

Re: [SOLVED] Can't login PAM issue

#6 2020-08-28 18:47:32

Re: [SOLVED] Can't login PAM issue

#7 2020-08-28 19:20:58

Re: [SOLVED] Can't login PAM issue

#8 2020-08-28 19:24:17

Re: [SOLVED] Can't login PAM issue

#9 2020-08-28 19:30:55

Re: [SOLVED] Can't login PAM issue

#10 2020-08-28 19:36:21

Re: [SOLVED] Can't login PAM issue

#11 2020-08-28 19:43:28

Re: [SOLVED] Can't login PAM issue

#12 2020-08-28 19:47:24

Re: [SOLVED] Can't login PAM issue

#13 2020-08-28 19:51:55

Re: [SOLVED] Can't login PAM issue

#14 2020-08-28 19:59:57

Re: [SOLVED] Can't login PAM issue

#15 2020-08-28 20:00:25

Re: [SOLVED] Can't login PAM issue

#16 2020-08-28 20:01:06

Re: [SOLVED] Can't login PAM issue

#17 2020-08-28 20:09:42

Re: [SOLVED] Can't login PAM issue

#18 2020-08-28 20:11:07

Re: [SOLVED] Can't login PAM issue

#19 2020-08-28 20:16:36

Re: [SOLVED] Can't login PAM issue

Board footer