Arch Linux

Tharbad

Member

Registered: 2016-02-27

Posts: 333

Sudo sometimes fails after upgarding pam to v1.4

Hi,

After the recent pam and pambase update, I sometimes can't use sudo. Login and su work.
Usually after upgrading back to v1.4 it will work for a while.

journalctl show this after each failed attempt:

audit[620373]: USER_AUTH pid=620373 uid=1000 auid=1000 ses=2 msg='op=PAM:authentication grantors=? acct="<user>" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=failed'
kernel: audit: type=1100 audit(1599668516.072:485): pid=620373 uid=1000 auid=1000 ses=2 msg='op=PAM:authentication grantors=? acct="<user>" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=failed'

Ideas?

Thanks

hold

Member

Registered: 2020-12-14

Posts: 3

Re: Sudo sometimes fails after upgarding pam to v1.4

I have the same issue - have you found a solution by now?
It sometimes also affects my lock screen (under gnome / gdm), and I think it happens more often after suspend.

comradeblue

Member

Registered: 2020-11-15

Posts: 1

Re: Sudo sometimes fails after upgarding pam to v1.4

In /etc/security/faillock.conf, you can set deny = 0 to disable lockouts, or adjust the unlock_time if you'd like to keep lockouts but reduce the amount of time the user is locked out.

Some defaults changed, and now by default after 3 failed password attempts the user is locked out for 10 minutes/600 seconds.

Relevant portion of the config:

# Deny access if the number of consecutive authentication failures
# for this user during the recent interval exceeds n tries.
# The default is 3.
# deny = 3
#
# The length of the interval during which the consecutive
# authentication failures must happen for the user account
# lock out is <replaceable>n</replaceable> seconds.
# The default is 900 (15 minutes).
# fail_interval = 900
#
# The access will be re-enabled after n seconds after the lock out.
# The value 0 has the same meaning as value `never` - the access
# will not be re-enabled without resetting the faillock
# entries by the `faillock` command.
# The default is 600 (10 minutes).
# unlock_time = 600

Last edited by comradeblue (2020-12-20 11:19:36)