You are not logged in.
Starting yesterday, on occasion when I try to type in my password (be it logging into a getty or when invoking sudo) I am told it is wrong, when it's not. I've had the same password for on this computer for years (I know that's bad form, but I'm lazy), I watched myself type it in, I checked caplock, and I even typed it in someplace I could see the output. It's not taking my password.
The only relevant logs I could think of are dmesg, journalctl, and pacman.log
Yesterday, I checked /etc/pam.d for "tally" based on another thread a few months back, but found nothing. If it is PAM, it isn't the first time it's given me trouble, but it doesn't seem like it's been changed recently.
audit: type=1100 audit(1608304331.525:480): pid=35412 uid=1000 auid=1000 ses=2 msg='op=PAM:authentication grantors=? acct="nstgc5" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=failed'Dec 18 10:12:11 Host audit[35412]: USER_AUTH pid=35412 uid=1000 auid=1000 ses=2 msg='op=P>
Dec 18 10:12:11 Host kernel: audit: type=1100 audit(1608304331.525:480): pid=35412 uid=10>
Dec 18 10:12:13 Host sudo[35412]: nstgc5 : 3 incorrect password attempts ; TTY=pts/1 ; >[2020-12-17T09:23:40-0500] [PACMAN] Running 'pacman -S sigil'
[2020-12-17T09:23:57-0500] [ALPM] transaction started
[2020-12-17T09:23:57-0500] [ALPM] installed python-certifi (2020.6.20-3)
[2020-12-17T09:23:57-0500] [ALPM] installed python-dulwich (0.20.14-2)
[2020-12-17T09:23:57-0500] [ALPM] installed sigil (1.4.3-1)
[2020-12-17T09:24:00-0500] [ALPM] transaction completed
[2020-12-17T09:24:00-0500] [ALPM] running '30-systemd-update.hook'...
[2020-12-17T09:24:00-0500] [ALPM] running 'gtk-update-icon-cache.hook'...
[2020-12-17T09:24:00-0500] [ALPM] running 'update-desktop-database.hook'...
[2020-12-17T09:28:17-0500] [PACMAN] Running 'pacman -S hyphen-en pageedit'
[2020-12-17T09:28:20-0500] [ALPM] transaction started
[2020-12-17T09:28:20-0500] [ALPM] installed hyphen-en (2.8.8-3)
[2020-12-17T09:28:20-0500] [ALPM] installed pageedit (1.4.0-1)
[2020-12-17T09:28:20-0500] [ALPM] transaction completed
[2020-12-17T09:28:20-0500] [ALPM] running '30-systemd-update.hook'...
[2020-12-17T09:28:20-0500] [ALPM] running 'gtk-update-icon-cache.hook'...
[2020-12-17T09:28:20-0500] [ALPM] running 'update-desktop-database.hook'...
[2020-12-17T17:42:26-0500] [PACMAN] Running 'pacman -Su'
[2020-12-17T17:42:26-0500] [PACMAN] starting full system upgrade
[2020-12-17T17:42:38-0500] [ALPM] transaction started
[2020-12-17T17:42:38-0500] [ALPM] upgraded pcre2 (10.35-1 -> 10.36-1)
[2020-12-17T17:42:39-0500] [ALPM] upgraded firefox (83.0-2 -> 84.0-1)
[2020-12-17T17:42:39-0500] [ALPM] upgraded libgdm (3.38.2-1 -> 3.38.2.1-1)
[2020-12-17T17:42:48-0500] [ALPM] upgraded python (3.9.0-1 -> 3.9.1-1)
[2020-12-17T17:42:48-0500] [ALPM] upgraded webkit2gtk (2.30.3-1 -> 2.30.4-1)
[2020-12-17T17:42:50-0500] [ALPM] upgraded mutter (3.38.2-2 -> 3.38.2+4+g00e247ed7-1)
[2020-12-17T17:42:51-0500] [ALPM] upgraded gnome-shell (1:3.38.2-1 -> 1:3.38.2+11+gd5fb557b3-1)
[2020-12-17T17:42:51-0500] [ALPM] upgraded openblas (0.3.12-1 -> 0.3.13-1)
[2020-12-17T17:43:00-0500] [ALPM] upgraded python-setuptools (1:50.3.2-4 -> 1:51.0.0-1)
[2020-12-17T17:43:00-0500] [ALPM] upgraded python-pyopenssl (20.0.0-1 -> 20.0.1-1)
[2020-12-17T17:43:00-0500] [ALPM] upgraded smbclient (4.13.2-3 -> 4.13.3-1)
[2020-12-17T17:43:02-0500] [ALPM] upgraded samba (4.13.2-3 -> 4.13.3-1)
[2020-12-17T17:43:04-0500] [ALPM] upgraded thunderbird (78.5.1-1 -> 78.6.0-1)
[2020-12-17T17:43:07-0500] [ALPM] transaction completed
[2020-12-17T17:43:07-0500] [ALPM] running '30-systemd-daemon-reload.hook'...
[2020-12-17T17:43:08-0500] [ALPM] running '30-systemd-tmpfiles.hook'...
[2020-12-17T17:43:08-0500] [ALPM-SCRIPTLET] Failed to write file "/sys/block/bcache0/bcache/sequential_cutoff": Invalid argument
[2020-12-17T17:43:08-0500] [ALPM-SCRIPTLET] Failed to write file "/sys/block/bcache1/bcache/sequential_cutoff": Invalid argument
[2020-12-17T17:43:08-0500] [ALPM-SCRIPTLET] Failed to write file "/sys/block/bcache2/bcache/sequential_cutoff": Invalid argument
[2020-12-17T17:43:08-0500] [ALPM] running '30-systemd-udev-reload.hook'...
[2020-12-17T17:43:08-0500] [ALPM] running '30-systemd-update.hook'...
[2020-12-17T17:43:08-0500] [ALPM] running 'glib-compile-schemas.hook'...
[2020-12-17T17:43:09-0500] [ALPM] running 'gtk-update-icon-cache.hook'...
[2020-12-17T17:43:09-0500] [ALPM] running 'update-desktop-database.hook'...
[2020-12-17T17:45:01-0500] [PACMAN] Running 'pacman -Syu'
[2020-12-17T17:45:01-0500] [PACMAN] synchronizing package lists
[2020-12-17T17:45:03-0500] [PACMAN] starting full system upgrade
[2020-12-17T17:45:27-0500] [ALPM] transaction started
[2020-12-17T17:45:27-0500] [ALPM] upgraded libx11 (1.7.0-1 -> 1.7.0-2)
[2020-12-17T17:45:27-0500] [ALPM] upgraded glib2 (2.66.3-1 -> 2.66.4-1)
[2020-12-17T17:45:27-0500] [ALPM] upgraded cairo (1.17.4-2 -> 1.17.4-3)
[2020-12-17T17:45:27-0500] [ALPM] upgraded cifs-utils (6.11-2 -> 6.11-3)
[2020-12-17T17:45:27-0500] [ALPM] upgraded diffoscope (161-3 -> 163-1)
[2020-12-17T17:45:28-0500] [ALPM] upgraded imagemagick (7.0.10.49-1 -> 7.0.10.50-1)
[2020-12-17T17:45:28-0500] [ALPM] upgraded lib32-glib2 (2.66.3-1 -> 2.66.4-1)
[2020-12-17T17:45:28-0500] [ALPM] upgraded lib32-cairo (1.17.4-2 -> 1.17.4-3)
[2020-12-17T17:45:28-0500] [ALPM] upgraded lib32-libtirpc (1.2.6-1 -> 1.3.1-1)
[2020-12-17T17:45:29-0500] [ALPM] upgraded libibus (1.5.23+1+gdd4cc5b0-3 -> 1.5.23+3+gaa558de8-1)
[2020-12-17T17:45:53-0500] [ALPM] upgraded libreoffice-fresh (7.0.3-6 -> 7.0.4-1)
[2020-12-17T17:45:53-0500] [ALPM] upgraded opera-ffmpeg-codecs (87.0.4280.67-1 -> 87.0.4280.88-1)
[2020-12-17T17:45:54-0500] [ALPM] upgraded pcsx2 (1.7.0.r655.16d33f896-1 -> 1.7.0.r686.03445d0b5-1)
[2020-12-17T17:45:54-0500] [ALPM] upgraded perl-libwww (6.49-1 -> 6.50-1)
[2020-12-17T17:45:54-0500] [ALPM] upgraded python-requests (2.25.0-1 -> 2.25.1-1)
[2020-12-17T17:45:54-0500] [ALPM] upgraded xorg-server-common (1.20.10-2 -> 1.20.10-3)
[2020-12-17T17:45:54-0500] [ALPM] upgraded xorg-server (1.20.10-2 -> 1.20.10-3)
[2020-12-17T17:45:54-0500] [ALPM] upgraded xorg-server-devel (1.20.10-2 -> 1.20.10-3)
[2020-12-17T17:45:54-0500] [ALPM] upgraded xorg-xwayland (1.20.0.r797.g5d73a8b59-1 -> 1.20.0.r800.ge4a9f0bb4-1)
[2020-12-17T17:45:54-0500] [ALPM] transaction completed
[2020-12-17T17:45:55-0500] [ALPM] running '30-systemd-update.hook'...
[2020-12-17T17:45:55-0500] [ALPM] running 'detect-old-perl-modules.hook'...
[2020-12-17T17:45:57-0500] [ALPM] running 'gtk-update-icon-cache.hook'...
[2020-12-17T17:45:57-0500] [ALPM] running 'update-desktop-database.hook'...
[2020-12-17T17:45:57-0500] [ALPM] running 'update-mime-database.hook'...
[2020-12-17T22:30:18-0500] [PACMAN] Running 'pacman -Su'
[2020-12-17T22:30:18-0500] [PACMAN] starting full system upgrade
[2020-12-17T22:30:18-0500] [PACMAN] Running 'pacman -Syuw --noconfirm'
[2020-12-17T22:30:18-0500] [PACMAN] synchronizing package lists
[2020-12-17T22:30:20-0500] [PACMAN] starting full system upgradeOffline
Have you read Security#Lock_out_user_after_three_failed_login_attempts?
Offline
Have you read Security#Lock_out_user_after_three_failed_login_attempts?
I am aware of this. This is not the case. This does get triggered, but the correct password is being input from the start.
Offline
If you reverse the pacman update can you still produce the issue?
Offline
I've experienced this behavior occasionally in the terminal. No matter how many times I enter the CORRECT password, it still tells me it's incorrect. Rebooting fixes the issue for me, and it doesn't happen with enough frequency to have motivated me to figure out exactly why it is occurring.
Registered Linux User: #623501 | Arch Linux Principles: Simplicity - Modernity - Pragmatism - User Centrality - Versatility => KISS
Arch Linux, the most exciting thing since Linus created Linux and married it with GNU/GPL.
Arch Linux for Life, Arch Linux Forever!
Offline
This is not the case. This does get triggered, but the correct password is being input from the start.
Let's test that theory:
Is there a failing sudo log w/o the "3 incorrect password attempts" error?
(Should be two at least…)
If you keep a root shell around (or open the command in sudoers), does "faillock --reset --user stgc5" resolve the issue?
Offline
If you keep a root shell around (or open the command in sudoers), does "faillock --reset --user stgc5" resolve the issue?
This fixed a really annoying issue where greeter login would intermittently fail with a known good password, and all attempts to sudo and su failed. Thanks!
Offline