I post this here instead of in the Security forum because I feel that it's more of a programming bug in KDE, and not a compromisable loophole or an exploit. I assume that updating something through YaST2 introduced it into my SuSE 9.1 Pro system.

About three months ago, I noticed that while I could log into KDE using any user account or the root account, once the session had started, passwords no longer worked for almost any application.

Scenario 1: I log into KDE as "User", password "foo", and the session starts up fine. I work for awhile and leave the computer - the screen saver comes on. I return and type in my password "foo", and the password is rejected.

Scenario 2: I log into KDE as "User", pw "foo", and just for grins open a console and "su User" Password: "foo"... Incorrect password.

Oddly, I can SSH into localhost just fine - the password is accepted in that case, and also by Kopete. Nothing else, though.

I have looked for months for a clue as to what may be causing this, and I'm drawing a complete blank. I know that one solution involving joining the "wheel" group does not resolve the issue. Does anyone have any ideas?

It's probably a keyboard mapping problem.

I don't understand - you mean that even though everything I type in before and after the password clearly has the letters I intended, somehow when it's in a password-entry box and covered by asterisks, the keys are mapped differently? How or why would keyboard mapping change between text boxes within the same application/console window?

Or do you mean that maybe somehow the programs formerly looked for passwords in ASCII, but now they want them in Unicode?

I'd really appreciate it if you'd elaborate a little bit more - I'm not sure that I understand what you are trying to get across. ;0)

Try creating a user with only "standard" keys in the username and password and see how that works, ie. if you create a user "111" with password "111". If you can log in then it's a keymap problem...

Keymap problems are most common when you have special characters such as Æ, Ø Å or ~ $ # etc in the password, as their keyboard location depends on the locale..

-Y1