[SOLVED]too many unsuccessful login attempts

gabx · 2026-01-04 21:50:00

I am in a very weird situation. I logged off my machine a few days ago and shut it down after a "eventless session" (no special issues during the session). Since then, nobody had access to the box. When trying to logging today, I had the following message when entering my password: too many unsuccessful login attempts for user XXX, refusing.
I can't understand this situation as I didn't attempted to logging since the last shutdown.
What can explain this issue? How can I fix it?
Details: I use COSMIC desktop manager and log in with gdm. My arch is up to date with no special or fancy setups.

Last edited by gabx (2026-01-05 04:17:45)

seth · 2026-01-04 22:56:53

What can explain this issue?

Still using homed?
Did the "eventless session" see any updates or tempering w/ that (notably maybe editing some pam rules?)
Can you still log in on the console?

How can I fix it?

https://wiki.archlinux.org/title/Securi … n_attempts

gabx · 2026-01-04 23:31:09

Yes I use systemd homectl.
I can't remember if I made some updates, but I would say yes. As for pam configuration files, I don't think I edited some of them.
When logging into console, same issue: too many attempts.

Last edited by gabx (2026-01-04 23:47:44)

seth · 2026-01-04 23:45:34

ctrl+alt+f3
Since faillock is transient it should also disappear on reboot, but if GDM somehow implicitly triggers this you'd have to boot the multi-user.target to avoid that (2nd link below)
The root account isn't supposed to be affected by faillock and the cause *might* be a failure of sysmted-homed (check the journal) or its pam module being missing from some pam config (GDM, in this case)

gabx · 2026-01-04 23:52:50

I can boot as root from the console.
Not sure what I shall check, but I will try to fix the issue from the root account session.
If you can give me some hints about what shall I check, I would appreciate.

seth · 2026-01-04 23:55:53

https://wiki.archlinux.org/title/Securi … n_attempts explains how to
1) reset the faillock
2) disable or weaken the faillock conditions

As for the cause your best shot is the system journal to see whether login/pam or systemd-homed failure get logged there.
Logging in as your regular user on the console also doesn't work?

gabx · 2026-01-04 23:57:06

Form journalctl, I see one red error:
Systemd-homed activation failed:home gabx is currently being used, or an operation on home gabx is currently being executed. Home directory /home/gabx exists, is not mounted but populated, refusing.
Next lines, in white color:
Provided password unlocks user record.
gabx: changing State inactive ---> activating-for-acquire
Unable to determinate state of home directory, ignoring:device or resource busy.
From journalctl --failed, I found some errors from snapper. That makes sense as I installed during my last session a script and it's service file to make regular snapshots of some of my directories. I deleted some snapper dedicated directories and thought I already removed snapper from my machine. But apparently I was wrong.
I have uninstalled now snapper, but still can't boot from my user account.
What can be the next step?

Last edited by gabx (2026-01-05 00:09:19)

gabx · 2026-01-05 00:34:06

I can't log as my regular user from the console.
I ran the fail lock command but this doesn't change anything.
From journalctl, the only relevant informations are the ones I mentioned in my previous post:
Pam_unix authentication failure;logname=LOGIN uid=0 euid=0 tty=/dev/tty3 ruser= rhost= user=gabx
Password check for user gabx
Pam_sytsmed_homed failed to acquire home for user gabx:home gabx is currently being used, or an operation on home gabx is currently being executed

gabx · 2026-01-05 01:00:42

After some searches, I found many threads about this issue, but most of all answers point to the faillock command, which doesn't work in my case.
One thread had a different solution with pam_tally and a modification of /etc/pam.d/system-auth, but as I don't fully understand I prefer not going this way.

gabx · 2026-01-05 04:21:58

My issue was due to my home gabx currently being used, or an operation on home gabx is currently being executed. I couldn't do anything.
In short, i copied /home/gabx.homedir,
then with homectl: deleted user gabx, create again user gabx
mounted btrfs subvolume @home/gabx.homedir.backup to rsync my new /home/gabx.
Et voilà

Arch Linux

#1 2026-01-04 21:50:00

[SOLVED]too many unsuccessful login attempts

#2 2026-01-04 22:56:53

Re: [SOLVED]too many unsuccessful login attempts

#3 2026-01-04 23:31:09

Re: [SOLVED]too many unsuccessful login attempts

#4 2026-01-04 23:45:34

Re: [SOLVED]too many unsuccessful login attempts

#5 2026-01-04 23:52:50

Re: [SOLVED]too many unsuccessful login attempts

#6 2026-01-04 23:55:53

Re: [SOLVED]too many unsuccessful login attempts

#7 2026-01-04 23:57:06

Re: [SOLVED]too many unsuccessful login attempts

#8 2026-01-05 00:34:06

Re: [SOLVED]too many unsuccessful login attempts

#9 2026-01-05 01:00:42

Re: [SOLVED]too many unsuccessful login attempts

#10 2026-01-05 04:21:58

Re: [SOLVED]too many unsuccessful login attempts

Board footer