[SOLVED] Locked out of encrypted account after update + reboot

Nosl33p · 2022-04-22 14:38:17

Hi!

So fairly recently made the switch from Manjaro to Arch. Running KDE and encrypted with the help from this guide. https://lunaryorn.com/install-arch-with … temd-homed

Everything worked fine and dandy until today when I did my pacman -Suy with the new Linux update.

After reboot, I get the graphical KDE login screen with my account pre-selected. However, when I type in the right credentials, the screen goes black for a while and then back to the login screen. I am able to login with the root account to get in, and through that in console change user to my own, but that is as close as I come.

Any possibility of a step in the right direction? I'm aware that I was slightly over my head going with that level of encryption.

Thanks a million in advance.

Update: Was able to (somewhat) access my account in tty. However, I get "permission denied" on ~, even with the right credentials.

Last edited by Nosl33p (2022-04-23 14:42:13)

ewaller · 2022-04-22 15:31:47

Welcome to the forums. When logged into the tty, do you have the ability to ls -l /home and can you share that output?

Nosl33p · 2022-04-22 15:54:51

Thank you! Long time lurker, first time writing.

ls -l /home gives me:

drwx------ 1 root root 0 Apr 16:53. *username*
-rw------ 1 root root (filesize of HD) Apr 22 14:18 *username*.home

ewaller · 2022-04-22 16:16:03

I would expect the user and group of *username* to be *username* as opposed to root. That tells me you don't have permissions to see into your home directory.

We need to figure out how that happened. Are you using a separate partition mounted on /home ? If so, is it mounting correctly?

Nosl33p · 2022-04-22 17:11:04

I agree. I think however that the reason for the ownership might be connected to the home folder being encrypted? It was made through the following command: homectl create *username* --storage luks --fs-type btrfs

Home is not on a separate partition. My boot drive has two partitions, EFI and /. Both seem to mount fine.

I was able to create another user, so the issue seem to be something connected to my user that should unlock during boot not unlocking. Is there a way I can look for that?

Thank you very much for taking the time!

ewaller · 2022-04-22 17:29:09

I am not your man for luks and encrypted volumes. I don't use them myself.
My suggestion would be to elevate privilege and change the user and group to that of your username. Then try logging into kde as your user. Then, see if the 'fix' is persistent across boots.

progandy · 2022-04-22 17:50:36

Since you used homectl, can you try its commands like "homectl inspect" or "homectl with"? I have never used it, so that is as far as my knowledge goes.

Nosl33p · 2022-04-22 17:58:38

Thank you my friend!

I was able to login to my account changing the privileges, which feels like a step in the right direction. My home folder is however still locked, which means that I'm in some kind of vanilla KDE. Also, when using Sudo I have to enter my password three times. First two times for the user, last time for "%p"?

I've also figured out that half of the setup should be considered working. I'm able to unlock the root drive, also encrypted, during boot. What I'm unable to work out is what part of the decryption of my home folder is failing.

homectl inspect gives the following:

User name: *username*
       State: inactive
 Disposition: regular
 Last Change: Sat 2022-04-16 16:48:01 CEST
    Login OK: yes
 Password OK: yes
         UID: 60510
         GID: 60510 (*username*)
   Directory: /home/*username*
     Storage: luks (strong encryption)
  Image Path: /home/*username*.home
   Removable: no
       Shell: /bin/bash
LUKS Discard: online=no offline=yes
   LUKS UUID: *****************************
   Part UUID: *****************************
     FS UUID: *****************************
 File System: btrfs
 LUKS Cipher: aes
 Cipher Mode: xts-plain64
  Volume Key: 256bit
 Mount Flags: nosuid nodev exec
   Disk Size: 43.0G
  Disk Floor: 256.0M
Disk Ceiling: 437.0G
  Good Auth.: 79
   Last Good: Fri 2022-04-22 14:16:43 CEST
   Bad Auth.: 162
    Last Bad: Fri 2022-04-22 19:42:26 CEST
    Next Try: anytime
 Auth. Limit: 30 attempts per 1min
   Passwords: 1
  Local Sig.: yes
  Service: io.systemd.Home

If anyone can direct me towards for example what logs to look at for further investigation I'd be very happy. My goal is obviously to learn as much as possible. Any suggestions on relevant tags or other ways to reach out is much appreciated.

Last edited by Nosl33p (2022-04-23 06:08:07)

loqs · 2022-04-22 18:43:54

Please post the journal for an attempted login.

Nosl33p · 2022-04-22 19:30:27

Good idea! I think I found some suspicious things in journalctl.

Apr 22 21:20:48 hello systemd-modules-load[799]: Failed to look up module alias 'crypto_user': Function not implemented
Apr 22 21:20:48 hello systemd[1]: Started Journal Service.
Apr 22 21:20:48 hello systemd-modules-load[799]: Failed to look up module alias 'ipmi-devintf': Function not implemented
Apr 22 21:20:48 hello systemd-modules-load[799]: Failed to look up module alias 'nvidia-uvm': Function not implemented

...

Apr 22 21:20:48 hello systemd[1]: efi.mount: Failed with result 'exit-code'.
Apr 22 21:20:48 hello systemd[1]: Failed to mount EFI System Partition Automount.
Apr 22 21:20:48 hello bootctl[838]: Failed to check file system type of "/efi": No such device
Apr 22 21:20:48 hello systemd[1]: systemd-boot-system-token.service: Main process exited, code=exited, status=1/FAILURE
Apr 22 21:20:48 hello systemd[1]: systemd-boot-system-token.service: Failed with result 'exit-code'.
Apr 22 21:20:48 hello systemd[1]: Failed to start Store a System Token in an EFI Variable.

...

Apr 22 21:20:56 hello sddm-greeter[1023]: Reading from "/usr/share/xsessions/plasma.desktop"
Apr 22 21:20:56 hello sddm[990]: Message received from greeter: Login
Apr 22 21:20:56 hello sddm[990]: Reading from "/usr/share/xsessions/plasma.desktop"
Apr 22 21:20:56 hello dbus-daemon[948]: [system] Would reject message, 3 matched rules; type="method_call", sender=":1.8" (uid=0 pid=990 comm="/usr/bin/sddm") interface="org.freedesktop.login1.Manager" member="ListSessions" error name="(unset)" requested_reply="0" destination="or>
Apr 22 21:20:56 hello sddm[990]: Reading from "/usr/share/xsessions/plasma.desktop"
Apr 22 21:20:56 hello sddm[990]: Session "/usr/share/xsessions/plasma.desktop" selected, command: "/usr/bin/startplasma-x11"
Apr 22 21:20:56 hello sddm-helper[1083]: [PAM] Starting...
Apr 22 21:20:56 hello sddm-helper[1083]: [PAM] Authenticating...
Apr 22 21:20:56 hello dbus-daemon[948]: [system] Would reject message, 3 matched rules; type="method_call", sender=":1.20" (uid=0 pid=1083 comm="/usr/lib/sddm/sddm-helper --socket /tmp/sddm-authd") interface="org.freedesktop.home1.Manager" member="GetUserRecordByName" error name=>
Apr 22 21:20:56 hello dbus-daemon[948]: [system] Would reject message, 2 matched rules; type="method_call", sender=":1.4" (uid=0 pid=961 comm="/usr/lib/systemd/systemd-homed") interface="org.freedesktop.DBus" member="GetConnectionUnixUser" error name="(unset)" requested_reply="0">
Apr 22 21:20:56 hello dbus-daemon[948]: [system] Would reject message, 3 matched rules; type="method_call", sender=":1.20" (uid=0 pid=1083 comm="/usr/lib/sddm/sddm-helper --socket /tmp/sddm-authd") interface="org.freedesktop.home1.Manager" member="AcquireHome" error name="(unset)>
Apr 22 21:20:56 hello systemd-homed[961]: *username*: changing state inactive <E2><86><92> activating-for-acquire
Apr 22 21:20:56 hello systemd-homework[1084]: None of the supplied plaintext passwords unlock the user record's hashed passwords.
Apr 22 21:20:56 hello systemd-homed[961]: Activation failed: Required key not available
Apr 22 21:20:56 hello systemd-homed[961]: *username*: changing state activating-for-acquire <E2><86><92> inactive
Apr 22 21:20:56 hello systemd-homed[961]: Got notification that all sessions of user *username* ended, deactivating automatically.
Apr 22 21:20:56 hello systemd-homed[961]: Home *username* already deactivated, no automatic deactivation needed.
Apr 22 21:20:56 hello sddm-helper[1083]: [PAM] Preparing to converse...
Apr 22 21:20:56 hello systemd-homed[961]: Unable to determine state of home directory, ignoring: Device or resource busy
Apr 22 21:20:56 hello sddm-helper[1083]: [PAM] Conversation with 1 messages
Apr 22 21:20:56 hello dbus-daemon[948]: [system] Would reject message, 3 matched rules; type="method_call", sender=":1.20" (uid=0 pid=1083 comm="/usr/lib/sddm/sddm-helper --socket /tmp/sddm-authd") interface="org.freedesktop.home1.Manager" member="AcquireHome" error name="(unset)>
Apr 22 21:20:56 hello systemd-homed[961]: *username*: changing state inactive <E2><86><92> activating-for-acquire
Apr 22 21:20:56 hello systemd-homework[1085]: Provided password unlocks user record.
Apr 22 21:20:56 hello systemd-homework[1085]: Home directory /home/*username* exists, is not mounted but populated, refusing.
Apr 22 21:20:56 hello systemd-homed[961]: Activation failed: Device or resource busy
Apr 22 21:20:56 hello systemd-homed[961]: *username*: changing state activating-for-acquire <E2><86><92> inactive
Apr 22 21:20:56 hello systemd-homed[961]: Got notification that all sessions of user *username* ended, deactivating automatically.
Apr 22 21:20:56 hello systemd-homed[961]: Home *username* already deactivated, no automatic deactivation needed.
Apr 22 21:20:56 hello systemd-homed[961]: Unable to determine state of home directory, ignoring: Device or resource busy
Apr 22 21:20:56 hello sddm-helper[1083]: pam_systemd_home(sddm:auth): Failed to acquire home for user *username*: Home *username* is currently being used, or an operation on home *username* is currently being executed.
Apr 22 21:20:56 hello sddm-helper[1083]: [PAM] Preparing to converse...
Apr 22 21:20:56 hello sddm-helper[1083]: [PAM] Conversation with 1 messages
Apr 22 21:20:56 hello audit[1083]: USER_AUTH pid=1083 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication grantors=pam_shells,pam_faillock,pam_permit,pam_faillock acct="*username*" exe="/usr/lib/sddm/sddm-helper" hostname=? addr=? terminal=? res=success'
Apr 22 21:20:56 hello sddm-helper[1083]: [PAM] returning.
Apr 22 21:20:56 hello dbus-daemon[948]: [system] Would reject message, 3 matched rules; type="method_call", sender=":1.20" (uid=0 pid=1083 comm="/usr/lib/sddm/sddm-helper --socket /tmp/sddm-authd") interface="org.freedesktop.home1.Manager" member="RefHome" error name="(unset)" re>
Apr 22 21:20:56 hello dbus-daemon[948]: [system] Would reject message, 2 matched rules; type="method_call", sender=":1.4" (uid=0 pid=961 comm="/usr/lib/systemd/systemd-homed") interface="org.freedesktop.DBus" member="GetConnectionUnixUser" error name="(unset)" requested_reply="0">
Apr 22 21:20:56 hello dbus-daemon[948]: [system] Would reject message, 3 matched rules; type="method_call", sender=":1.20" (uid=0 pid=1083 comm="/usr/lib/sddm/sddm-helper --socket /tmp/sddm-authd") interface="org.freedesktop.home1.Manager" member="AcquireHome" error name="(unset)>
Apr 22 21:20:56 hello kernel: audit: type=1100 audit(1650655256.728:153): pid=1083 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication grantors=pam_shells,pam_faillock,pam_permit,pam_faillock acct="*username*" exe="/usr/lib/sddm/sddm-helper" hostname=? addr=? terminal=? re>
Apr 22 21:20:56 hello systemd-homed[961]: *username*: changing state inactive <E2><86><92> activating-for-acquire
Apr 22 21:20:56 hello systemd-homework[1086]: None of the supplied plaintext passwords unlock the user record's hashed passwords.
Apr 22 21:20:56 hello systemd-homed[961]: Activation failed: Required key not available
Apr 22 21:20:56 hello systemd-homed[961]: *username*: changing state activating-for-acquire <E2><86><92> inactive
Apr 22 21:20:56 hello systemd-homed[961]: Got notification that all sessions of user *username* ended, deactivating automatically.
Apr 22 21:20:56 hello systemd-homed[961]: Home *username* already deactivated, no automatic deactivation needed.
Apr 22 21:20:56 hello sddm-helper[1083]: [PAM] Preparing to converse...
Apr 22 21:20:56 hello sddm-helper[1083]: [PAM] Conversation with 1 messages
Apr 22 21:20:56 hello systemd-homed[961]: Unable to determine state of home directory, ignoring: Device or resource busy
Apr 22 21:20:56 hello dbus-daemon[948]: [system] Would reject message, 3 matched rules; type="method_call", sender=":1.20" (uid=0 pid=1083 comm="/usr/lib/sddm/sddm-helper --socket /tmp/sddm-authd") interface="org.freedesktop.home1.Manager" member="AcquireHome" error name="(unset)>
Apr 22 21:20:56 hello systemd-homed[961]: *username*: changing state inactive <E2><86><92> activating-for-acquire
Apr 22 21:20:56 hello systemd-homework[1087]: Provided password unlocks user record.
Apr 22 21:20:56 hello systemd-homework[1087]: Home directory /home/*username* exists, is not mounted but populated, refusing.
Apr 22 21:20:56 hello systemd-homed[961]: Activation failed: Device or resource busy
Apr 22 21:20:56 hello systemd-homed[961]: *username*: changing state activating-for-acquire <E2><86><92> inactive
Apr 22 21:20:56 hello systemd-homed[961]: Got notification that all sessions of user *username* ended, deactivating automatically.
Apr 22 21:20:56 hello systemd-homed[961]: Home *username* already deactivated, no automatic deactivation needed.
Apr 22 21:20:56 hello systemd-homed[961]: Unable to determine state of home directory, ignoring: Device or resource busy
Apr 22 21:20:56 hello sddm-helper[1083]: pam_systemd_home(sddm:account): Failed to acquire home for user *username*: Home *username* is currently being used, or an operation on home *username* is currently being executed.
Apr 22 21:20:56 hello audit[1083]: USER_ACCT pid=1083 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_permit,pam_time acct="*username*" exe="/usr/lib/sddm/sddm-helper" hostname=? addr=? terminal=? res=success'
Apr 22 21:20:56 hello sddm[990]: Authenticated successfully
Apr 22 21:20:56 hello sddm-greeter[1023]: Message received from daemon: LoginSucceeded

EDIT: Found some similar problems with systemctl status systemd-homed.

Apr 22 22:06:08 hello systemd-homed[955]: Activation failed: Required key not available
Apr 22 22:06:08 hello systemd-homed[955]: *username*: changing state activating-for-acquire <E2><86><92> inactive
Apr 22 22:06:08 hello systemd-homed[955]: Got notification that all sessions of user *username* ended, deactivating automatically.
Apr 22 22:06:08 hello systemd-homed[955]: Home *username* already deactivated, no automatic deactivation needed.
Apr 22 22:06:08 hello systemd-homed[955]: *username*: changing state inactive <E2><86><92> activating-for-acquire
Apr 22 22:06:08 hello systemd-homework[1098]: None of the supplied plaintext passwords unlock the user record's hashed passwords.
Apr 22 22:06:08 hello systemd-homed[955]: Activation failed: Required key not available
Apr 22 22:06:08 hello systemd-homed[955]: *username*: changing state activating-for-acquire <E2><86><92> inactive
Apr 22 22:06:08 hello systemd-homed[955]: Got notification that all sessions of user *username* ended, deactivating automatically.
Apr 22 22:06:08 hello systemd-homed[955]: Home *username* already deactivated, no automatic deactivation needed.

Last edited by Nosl33p (2022-04-23 06:07:53)

Strike0 · 2022-04-22 21:41:45

Try https://wiki.archlinux.org/title/System … for_rescue
to unlock the user's encrypted home via root.

2ManyDogs · 2022-04-22 22:42:05

Nosl33p, please edit your posts and use [ code ] tags (not quote tags) when posting output. This makes the output easier to read and provides a scroll box for long output.

https://wiki.archlinux.org/title/Genera … s_and_code
https://bbs.archlinux.org/help.php#bbcode

Nosl33p · 2022-04-23 06:32:28

Strike0 wrote:

Try https://wiki.archlinux.org/title/System … for_rescue
to unlock the user's encrypted home via root.

This gave a (for me) interesting result. When running losetup -fP --show --*username*.home I get

losetup: cannot find an unused loop device

Is Loop gone?

[root@hello tempuser]# modprobe loop
modprobe: FATAL: Module loop not found in directory /lib/modules/5.17.3-arch1-1

Looks like it.

Looking at /lib/modules I notice that I have two kernels installed.

[root@hello tempuser]# ls /lib/modules
5.15.35-1-lts  5.17.4-arch1-1

Now I remember that I opted for the LTS kernel at some point. I don't mind going into the deep end if I can save my install long enough to do another backup (Did some work before Timeshift had the time to save it).

This is my /boot/EFI/Linux

[root@hello tempuser]# ls /boot/EFI/Linux
linux-5.15.35-1-lts-99e47db1390242e0bd6128d88c194e31-rolling.efi  linux-5.17.4-arch1-1-99e47db1390242e0bd6128d88c194e31-rolling.efi

How can I either revert back to the old kernel or fully transform into the new one? Perferably in a way where I don't end up here with every update. From my noob perspective the discrepancy between the setups is likely the cause of the troubles.

Last edited by Nosl33p (2022-04-23 06:33:02)

Strike0 · 2022-04-23 08:14:33

Nosl33p wrote:

[root@hello tempuser]# modprobe loop
modprobe: FATAL: Module loop not found in directory /lib/modules/5.17.3-arch1-1
Looks like it.
Looking at /lib/modules I notice that I have two kernels installed.
[root@hello tempuser]# ls /lib/modules
5.15.35-1-lts  5.17.4-arch1-1

Two kernels, but the modules error is for a third one. My guess is you did an update and skipped rebooting into the 5.17.4 kernel before trying to modprobe.
The instructions are meant to be used via the Arch iso, booted. This should allow you to make a backup of your user's home directory in any case. You can backup both the luks-home in full (username.home), as well as selective after unlocking and mounting it.

Once you have the new system setup, simply create a new user and restore files. This may be simpler than trying to figure what went wrong, which could be (i'm guessing again):

man systemd.homed wrote:

In order to migrate a home directory from a host "foobar" to another host "quux" it is hence sufficient to
copy /var/lib/systemd/home/local.public from the host "foobar" to "quux", maybe calling the file on the
destination /var/lib/systemd/home/foobar.public, reflecting the origin of the key. If the user record
should be modifiable on "quux" the pair /var/lib/systemd/home/local.public and
/var/lib/systemd/home/local.private need to be copied from "foobar" to "quux", and placed under the
identical paths there, as currently only a single private key is supported per host. Note of course that
the latter means that user records generated/signed before the key pair is copied in, lose their validity.

Nosl33p · 2022-04-23 14:41:12

Thank you for this! Was able to solve the problem through backup of /home/, reinstalling Arch, creating new user and moving former backup to the new user. Might create some mess in the future, but for now I'm very pleased.

Marking as solved.

Strike0 wrote:

Nosl33p wrote:
[root@hello tempuser]# modprobe loop
modprobe: FATAL: Module loop not found in directory /lib/modules/5.17.3-arch1-1
Looks like it.
Looking at /lib/modules I notice that I have two kernels installed.
[root@hello tempuser]# ls /lib/modules
5.15.35-1-lts  5.17.4-arch1-1
Two kernels, but the modules error is for a third one. My guess is you did an update and skipped rebooting into the 5.17.4 kernel before trying to modprobe.
The instructions are meant to be used via the Arch iso, booted. This should allow you to make a backup of your user's home directory in any case. You can backup both the luks-home in full (username.home), as well as selective after unlocking and mounting it.
Once you have the new system setup, simply create a new user and restore files. This may be simpler than trying to figure what went wrong, which could be (i'm guessing again):
man systemd.homed wrote:
In order to migrate a home directory from a host "foobar" to another host "quux" it is hence sufficient to
copy /var/lib/systemd/home/local.public from the host "foobar" to "quux", maybe calling the file on the
destination /var/lib/systemd/home/foobar.public, reflecting the origin of the key. If the user record
should be modifiable on "quux" the pair /var/lib/systemd/home/local.public and
/var/lib/systemd/home/local.private need to be copied from "foobar" to "quux", and placed under the
identical paths there, as currently only a single private key is supported per host. Note of course that
the latter means that user records generated/signed before the key pair is copied in, lose their validity.

Arch Linux

#1 2022-04-22 14:38:17

[SOLVED] Locked out of encrypted account after update + reboot

#2 2022-04-22 15:31:47

Re: [SOLVED] Locked out of encrypted account after update + reboot

#3 2022-04-22 15:54:51

Re: [SOLVED] Locked out of encrypted account after update + reboot

#4 2022-04-22 16:16:03

Re: [SOLVED] Locked out of encrypted account after update + reboot

#5 2022-04-22 17:11:04

Re: [SOLVED] Locked out of encrypted account after update + reboot

#6 2022-04-22 17:29:09

Re: [SOLVED] Locked out of encrypted account after update + reboot

#7 2022-04-22 17:50:36

Re: [SOLVED] Locked out of encrypted account after update + reboot

#8 2022-04-22 17:58:38

Re: [SOLVED] Locked out of encrypted account after update + reboot

#9 2022-04-22 18:43:54

Re: [SOLVED] Locked out of encrypted account after update + reboot

#10 2022-04-22 19:30:27

Re: [SOLVED] Locked out of encrypted account after update + reboot

#11 2022-04-22 21:41:45

Re: [SOLVED] Locked out of encrypted account after update + reboot

#12 2022-04-22 22:42:05

Re: [SOLVED] Locked out of encrypted account after update + reboot

#13 2022-04-23 06:32:28

Re: [SOLVED] Locked out of encrypted account after update + reboot

#14 2022-04-23 08:14:33

Re: [SOLVED] Locked out of encrypted account after update + reboot

#15 2022-04-23 14:41:12

Re: [SOLVED] Locked out of encrypted account after update + reboot

Board footer