11

I have configured my screensavers to lock the desktop after some time; and sometimes, e.g. when I leave my desk, I prefer to lock the screen myself using the title bar "Lock/Switch account..." feature.

While trying to log in again, I enter my password, but the password is labeled as "invalid".

As a workaround, I have to use the mouse to go to the "Switch User..." menu in the title bar, click it, and wait for that other login page to appear, which is quite similar to the screensaver-lock page. (It also lists other the usernames to choose from)

There I enter the same password, and it gets accepted, I'm logged in, unity desktop appears.

Login at the console also works.

Any idea how to diagnose and solve the problem?

Linux xxx 3.19.0-28-generic #30-Ubuntu SMP Mon Aug 31 15:52:51 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

unity 7.3.2

Compiz 0.9.12.1

There seems to be nothing of interest in kern.log and syslog, but here is something from /var/log/auth.log

    Sep 17 17:20:29 xxx lightdm: pam_kwallet(lightdm-greeter:setcred): pam_sm_setcred
Sep 17 17:20:29 xxx lightdm: pam_unix(lightdm-greeter:session): session opened for user lightdm by (uid=0)
Sep 17 17:20:29 xxx systemd-logind[843]: New session c13 of user lightdm.
Sep 17 17:20:29 xxx lightdm: pam_ck_connector(lightdm-greeter:session): nox11 mode, ignoring PAM_TTY :2
Sep 17 17:20:29 xxx lightdm: pam_kwallet(lightdm-greeter:session): pam_sm_open_session
Sep 17 17:20:29 xxx lightdm: pam_kwallet(lightdm-greeter:session): pam_kwallet: open_session called without kwallet_key
Sep 17 17:20:30 xxx lightdm: pam_succeed_if(lightdm:auth): requirement "user ingroup nopasswdlogin" not met by user "knb"
Sep 17 17:20:33 xxx CRON[37168]: pam_unix(cron:session): session closed for user munin
Sep 17 17:21:10 xxx lightdm: pam_kwallet(lightdm:auth): pam_sm_authenticate
Sep 17 17:21:10 xxx lightdm: pam_kwallet(lightdm:setcred): pam_sm_setcred
Sep 17 17:21:10 xxx lightdm: pam_unix(lightdm-greeter:session): session closed for user lightdm
Sep 17 17:21:10 xxx lightdm: pam_kwallet(lightdm-greeter:session): pam_sm_close_session
Sep 17 17:21:10 xxx lightdm: pam_kwallet(lightdm-greeter:setcred): pam_sm_setcred

Here are some pictures of the screens I have to go through:

Step 1 - locked screensaver

Here I have unsuccessfully typed in my regular password. It contains only ascii characters.

Step 2 - switch user

Switch user ... (choose my own account, I don't need to switch to another one).

Step 3 - regular login

This works.

EDITED: just before end of +150 bounty deadline

I was able to solve this problem myself (after following though all hints and links spread throughout all the ~5 answers so far)

I had to comment out this line in file /etc/pam.d/lightdm:

#auth sufficient pam_succeed_if.so user ingroup nopasswdlogin

I think the reason was that (many months ago, when I was the "only one" with physical access to my computer) I've added myself to the group that can login without password, and autologin to lightdn after boot/reboot. Then some day I changed this back to "login needed after reboot" but for some reason the previous no-login configuration was removed improperly from all the config files.

Now can login again :-)

A note on the bounty / "grading":

The first answerer was closest to the solution by saying something like "look closely at what's in /etc/pam.d". The answer was also the longest and the most thorough. However I checked all the other answers as valuable, that's all I can do for now, I think.

  • 1
    Not directly related, but you need to do the same procedure when you lock the screen of a non-password account. The lock screen wants a password (that does not exist), but the user switching screen directly shows the login button without asking for a password. The lock screen really seems not to be well coded here... – Byte Commander Sep 18 '15 at 11:46
  • 1
    I have the exactly same problem, but haven't encountered it in a while. My password is also no special characters. It's hunter2 fyi. – Promille Sep 23 '15 at 17:42
  • Are you using LDAP? – muru Sep 24 '15 at 5:13
  • @muru - no LDAP. here I am using a local user account. I have the LDAP client installed and use it to connect other services (email,...) when I'm logged in – knb Sep 24 '15 at 7:21
  • 1
    @knb just checking to confirm you aren't bitten by bugs.launchpad.net/ubuntu/+source/unity/+bug/1314095 like I was. – muru Sep 24 '15 at 7:23
3
+150

In theory you can walk through the contents of /etc/pam.d and compare against the output from /var/log/auth.log to see what is going on.

In case you're not aware, each file in pam.d is a potential entry point to ask pam if you can get authority. In your case lightdm. The log entries are fairly self explanatory as far as figuring out which lines in the log come from which lines in the pam file.

According to the docs I found you should be able to add 'debug' to lines in pam.d files to get extra info in the log.

In my setup, I'm using kde, and kdm and I get lots of lines containing (kdm:auth) when I lock my screen and attempt to unlock it (with the wrong password), but nothing when it unlocks successfully. The is next to no comparison between pam.d/kdm and pam.d/lightdm which makes no sense to me, so maybe you can try swapping things around to see if the issue is in the lightdm pam module.

The only other thought I had, is whether you have interesting symbols or characters in your password. If the lightdm lock screen box, isn't coded properly you might find it's not sending what you type to the back end. Try changing your password to something basic (like 1234) to see if it works, if it does, then (change your password back obviously, but) it probably means there is nothing wrong with your pam configuration at least.

Sorry if this doesn't help much, beyond looking at adding pam_debug.so to various pam files (see http://manpages.ubuntu.com/manpages/hardy/man8/pam_debug.8.html), to see what happens, I'm not sure what else to suggest.

3

The lockscreen runs its authentication as a regular user, whereas user switching and the login screen run as root. Root has special privileges a regular user doesn't.

Usually when I've seen this problem, it's turned out that the permissions on the file /etc/shadow have been changed. The should look something like this.

$ ls -l /etc/shadow
-rw-r----- 1 root shadow 2202 Jun 23 12:39 /etc/shadow

If the perms, owner, or group are wrong, that's your problem right there.

  • my shadow file: looks pretty normal: -rw-r----- 1 root shadow 1965 Sep 22 08:49 /etc/shadow – knb Sep 24 '15 at 7:50
  • However the line in the shadow file that belongs to my login is really, really long: ... saned:*:15259:0:99999:7::: knb:$6$gUasL0rU$X3J3y/IAu/gKT2Ky2HCGLYigs59CowgYw17/0AK8QMWCsz6NpWDesH.C/....... LatrOQm1l5211gy3Q2pWx.:16702:0:99999:7::: sshd:*:15268:0:99999:7::: postfix:*:15271:0:99999:7: ..... – knb Sep 24 '15 at 8:01
1

Perhaps the solutions in Desktop login fails, terminal works will work for you?

They removed the ~/.Xauthority file.

Or here? https://unix.stackexchange.com/questions/64545/suddenly-i-cant-login-with-correct-password-greeter-tty

Seems to be the same issue you're experiencing. For that second link, you may want to try simply running the last part of the commands, ignoring the apt-get purging: sudo pam-auth-update.

  • I have tried sudo pam-auth-update - result: warning + exit because of local modifications in /etc/pam.d/ . There were 4 /etc/pam.dcommon-* files . Then I did sudo pam-auth-update --force. complex config-dialog-box appeared, choosed defaults. now there are 5 common-* files . Problem is still there. – knb Sep 24 '15 at 8:03
0

Your answer (in your edit) did not really solve my issue but the accepted answer and your way of solving yours in the edit lead me to do the following:

  • commenting the following line

    #auth sufficient pam_succeed_if.so user ingroup nopasswdlogin

  • changing

    auth requisite pam_nologin.so to auth requisite pam_permit.so

side note: no need for restart after changing these lines just type this into the terminal : sudo /usr/sbin/pam-auth-update and then without changing anything in the menu hit enter on your keyboard

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.