System not accepting password after screenlock (CentOS 6.5)

thealmightyos · 05-22-2014, 09:28 AM

I had a very interesting experience this morning when I came into work and want to figure it out right away.

Last night before I left work I locked my screen like I always do. This morning I came in, moved the mouse and typed my password in the dialog box. Failed. Ok, maybe the capslock is on. Nope. Well I could have simply mistyped my password so I entered it in slowly and carefully. Fail. Typed it one key at a time. Fail. Attached another keyboard and typed it that way. Fail. Ensured that I was typing the correct password for the user displayed in the dialog which I was. At the end I had 30 failed unlocking attempts.

At this point I was completely out of options and did a hard shutdown. After rebooting the box it accepted my password first time at the login screen.

I attempted to replicate the issue however it took my password every time [EDIT]: I locked my pc when I walked away from my desk and when I came back it would not accept my password again. I was away for about 15 minutes. Could time be a factor?

What in the seven hells could have happened in order to cause this? The user account is local so it could not have been a connectivity error or a problem with an external server. Any ideas?

dijetlo · 05-22-2014, 10:22 AM

Password hash tables do corrupt, though rarely.
They never get better after they corrupt though, never.
So it's probably not the hash table.
If your on RHEL check /var/log/*. I'd start with sys, it'll tell you if that was actually a failed password (penetrated to the hash table) or was it "bounced" by some window process (perhaps the window manager dozes off, I know I do...

).

thealmightyos · 05-22-2014, 10:44 AM

Quote:

Originally Posted by dijetlo

Password hash tables do corrupt, though rarely.
They never get better after they corrupt though, never.
So it's probably not the hash table.
If your on RHEL check /var/log/*. I'd start with sys, it'll tell you if that was actually a failed password (penetrated to the hash table) or was it "bounced" by some window process (perhaps the window manager dozes off, I know I do...

).

Oddly enough, no sys logs. There are "secure" logs that do display a ton of login errors for xscreensaver:auth.

The errors are as follows:

Code:

wscreensaver: pam_unix(xscreensaver:auth): conversation failed
wscreensaver: pam_unix(xscreensaver:auth): auth could not identify password for [user]
unix_chkpwd[2941]: password check failed for user (user)
wscreensaver: pam_unix(xscreensaver:auth): authentication failure; logname= uid=500 euid=500 tty:0.0 ruser= rhost= user=user

dijetlo · 05-22-2014, 12:53 PM

Quote:

Oddly enough, no sys logs

Look at your /etc/syslog.conf and make whatever changes you deem appropriate.

Quote:

pam_unix(xscreensaver:auth): authentication failure; logname= uid=500 euid=500 tty:0.0 ruser= rhost= user=user

It looks like not only did you lock but you went into screensaver. When you tried to log in, your credentials seemed to have been passed to the the password hash (that's PAM) incorrectly.

Disabling the screensaver or disabling the "Password 2 Unlock" feature might fix this...or even synchronizing your domain login and your screensaver password...though disabling the thing is the most likely fix.
How do you feel about your screensaver?

EDIT: Just a note, Yas, I don't know that much about the KDE desktop, I rarely use it on my personal machines and I've only just been given responsibility for supporting it professionally. That's why I'm interested in your problem though to be hones, you may well know more about it than I

GaWdLy · 05-22-2014, 02:54 PM

Fedora 19 and 20 have issues where you lock, come back again, and it either won't accept keyboard entry, or when you type the text entry goes into a different window on the desktop.

I used to run into this a lot when I would leave a kvm vm in the foreground when the machine locked.

I don't know if any of the kvm or desktop bits are in CentOS 6.5. Just thought I'd relate some odd recent desktop password issues.