[SOLVED] Password randomly stops working

Yann21 · 2020-10-15 07:54:27

Hi,
I recently changed my user's password with passwd for security purposes.

What happens now is one moment the password will work, the next one I will get "Sorry, try again." with the exact same string of characters. I copy pasted the same password in two different terminals and got two different results.
I am having a hard time believing that the /etc/shadow could change itself on a dime.

I understand the SHA512 hashing mechanism. I've tested that the passwords I enter are indeed in /etc/shadow.
But what should I do now, is this some sort of well-known bug?

Resolution
The problem was coming from a rogue cronjob that frequently required privileges and was preventing me from logging in with my real password.
See pam_faillock and cron.

A warm thank you to those who helped me find the solution!

Last edited by Yann21 (2020-10-16 07:20:23)

schard · 2020-10-15 08:02:17

Wich technology do you use for that macro thingy?
On which types of authentication prompts does your issue occur? TTY login, graphical login manager, su, sudo....?
And no. A text file cannot change itself. It can only be changed by programs or disk errors.
You also stated that you changed your "'passwd'". I assume you mean your user's password, or did you indeed change the named program? If so, in what way?

Last edited by schard (2020-10-15 08:03:43)

DAMO238 · 2020-10-15 12:41:53

Make sure that your macro can work in the scenario that you need it. For example, if you are in your login manager but the macro only works when you load a program after logging in, you will be unable to use your macro. We need more information to be able to effectively help.

Yann21 · 2020-10-15 13:47:05

Thank you for your replies:

Macro explanation:
I use ckb-next for the macro. But to be clear, I know my password by heart and I typed it in several times.

Recent password change (suspected trigger):
I used to have the same password for root and user: old_pwd, I then changed the user's password to new_pwd with the command passwd. The problem arose only after initially changing the password.

Manifestation of the problem
1. I have no problem reaching the window manager from the display manager with either old_pwd or new_pwd.
2. When I try to sudo su / sudo command in xterm after logging in however, half of the time it will work with new_pwd, the other half it won't. It will typically change state after rebooting, opening a new terminal, or waiting long enough.
3. TTY exhibits the same behavior as xterm meaning that when I can access root privileges with new_pwd from xterm it will work in the TTY's and vice versa when the password doesn't work.

Update
Caught it red-handed. I have one terminal where the password works and another terminal where the password doesn't.
NB: This is not some sort of prank.

Last edited by Yann21 (2020-10-15 18:21:08)

Scimmia · 2020-10-15 13:53:57

Sounds more like the account is getting locked. Check out pam_faillock.

seth · 2020-10-15 14:40:54

Did you try to just macro the password into the shell prompt (not sudo) so you can see what happens?
If it contains any non-ascii chars, a broken locale could throw you off.

Also https://imgs.xkcd.com/comics/password_strength.png

Yann21 · 2020-10-15 15:58:49

@Scimmia, I'll look into it. The fact that there could be a timeout wouldn't surprise me at this point.

Thanks for the reply @seth. I have indeed looked at the output in plain text and I have also taken other precautions to ensure that the passwords are consistent and identical. It was the first thing that came to mind because it is after all the most likely cause. Sadly, this matter is very different as illustrated by my screenshot. You put the same string in two terminals (at 10s interval), and you get 2 different results.

mpan · 2020-10-15 16:00:32

Yann21:
Make sure the password is not being sent too fast, assuming you have a way to control the rate at which letters are being sent. I have encountered similar issues while using the auto-type feature of a password manager in various situations.

Another question, possibly more important, is: you have set up a new password and you have a single keyboard key to automatically send it to the input? Then… why using a password at all?

Yann21 · 2020-10-15 16:28:48

@mpan I never had the latency issue in the past, although it did cross my mind that's why I also copy pasted the password.

Your second question is a fair one and to tell you the truth I was in the process of phasing out redundant passwords. It is a big pain in the butt, not to mention me having to chase Schrödinger's password as we speak.

But technically speaking, isn't using a macro an extra layer of security, even if it's just one key press away? If someone has access to my files and looks for my macro he can already do all kinds of offline decryption on my hashed password anyway.

Last edited by Yann21 (2020-10-15 16:29:31)

seth · 2020-10-15 18:45:46

If you've two different shells and one accepts the password and the other does not (not talking about the sudo cache here) there's either different input or a different environment.

Next time this happens compare the output of
- printenv
- locale
- entering the passoword (via macro, I guess) into "od" (paste/macro it, hit enter and then ctrl+D)
in either shell.

Yann21 · 2020-10-15 19:46:56

Thankfully I didn't have to wait too long:
.
├── not_working
│   ├── env.log
│   ├── locale.log
│   └── od.log
├── res.txt
└── working
├── env.log
├── locale.log
└── od.log

Output of diff:
2c2
< WINDOWID=48234526
---
> WINDOWID=46137374
13c13
< GPG_TTY=/dev/pts/5
---
> GPG_TTY=/dev/pts/0
16c16
< PWD=/home/yann/tmp/password_issue/not_working
---
> PWD=/home/yann/forum/password_issue
57c57
< OLDPWD=/home/yann/tmp/password_issue
---
> OLDPWD=/home/yann/forum

Update
I reproduced the problem in the same terminal (ie same locale and everything). I think the issue might be coming from a very frequent user cronjob that required privileges (* * * * *). If the problem doesn't come back before an hour, I'll consider it solved.

Last edited by Yann21 (2020-10-15 19:51:47)

Arch Linux

#1 2020-10-15 07:54:27

[SOLVED] Password randomly stops working

#2 2020-10-15 08:02:17

Re: [SOLVED] Password randomly stops working

#3 2020-10-15 12:41:53

Re: [SOLVED] Password randomly stops working

#4 2020-10-15 13:47:05

Re: [SOLVED] Password randomly stops working

#5 2020-10-15 13:53:57

Re: [SOLVED] Password randomly stops working

#6 2020-10-15 14:40:54

Re: [SOLVED] Password randomly stops working

#7 2020-10-15 15:58:49

Re: [SOLVED] Password randomly stops working

#8 2020-10-15 16:00:32

Re: [SOLVED] Password randomly stops working

#9 2020-10-15 16:28:48

Re: [SOLVED] Password randomly stops working

#10 2020-10-15 18:45:46

Re: [SOLVED] Password randomly stops working

#11 2020-10-15 19:46:56

Re: [SOLVED] Password randomly stops working

Board footer