Arch Linux

Lax Lexis

Member

Registered: 2013-09-30

Posts: 87

[solved]login failed; encryption using dm-crypt and a pam_exec script

Hello there,

after the last system update I am not able to login anymore. I don't use a
login-manager. My nvme is encrypted by dm-crypt and the manually decryption
works. But if I try to login the message "Login failed" appears.

In the past I installed everything by this tutorial:
https://wiki.archlinux.org/index.php/Dm … g_at_login

/etc/pam.d/system-login

#%PAM-1.0

auth     required  pam_tally2.so   onerr=succeed file=/var/log/tallylog
auth     required  pam_shells.so
auth     requisite pam_nologin.so
auth     include   system-auth
auth     optional  pam_exec.so     expose_authtok /etc/pam.d/decrypt_on_login.sh

account  required  pam_tally2.so
account  required  pam_access.so
account  required  pam_nologin.so
account  include   system-auth

password include   system-auth

session  optional  pam_loginuid.so
session  optional  pam_keyinit.so  force revoke
session  include   system-auth
session  optional  pam_motd.so     motd=/etc/motd
session  optional  pam_mail.so     dir=/var/spool/mail standard quiet
-session optional  pam_systemd.so
session  required  pam_env.so
#session  optional  pam_exec.so     /usr/local/bin/luks_lock

/etc/pam.d/decrypt_on_login.sh

#!/bin/bash

CRYPT_USER="Lexis"
MAPPER="/dev/mapper/home-"$CRYPT_USER

if [ "$PAM_USER" == "$CRYPT_USER" ] && [ ! -e $MAPPER ]
then
  tr '\0' '\n' | /usr/bin/cryptsetup open /dev/nvme0n1p3 home-$CRYPT_USER
fi

All looking fine but there could be any other invisible control character in my password.
Any suggestions? Thanks!

Last edited by Lax Lexis (2020-09-14 11:58:09)

Viev

Member

Registered: 2020-07-24

Posts: 5

Re: [solved]login failed; encryption using dm-crypt and a pam_exec script

Tally2 is causing the problems. You can search the forum for the solution. For example replace the system-login with system-login.pacnew.

Lax Lexis

Member

Registered: 2013-09-30

Posts: 87

Re: [solved]login failed; encryption using dm-crypt and a pam_exec script

Thanks! No my login works again! :-)