Watch out: `pam` 1.4.0 may require manual intervention (pam_tally dropped)

General system Pacman
1

pam has been updated and the tally and tally2 modules were dropped. If these modules are present in your /etc/pam.d/system-login then your login will fail despite a correct user/pass (both in DM and terminal).

If you have altered the file contents in the past (e.g. you set up login via fingerprint reader) then pacman won’t replace it with the new version.

If you don’t make the change before rebooting then entering single-user mode (or using a chroot) will get you into the system, where you can edit /etc/pam.d/system-login:

 #%PAM-1.0
 
-auth       required   pam_tally2.so        onerr=succeed file=/var/log/tallylog
 auth       required   pam_shells.so
 auth       requisite  pam_nologin.so
 auth       include    system-auth
 
-account    required   pam_tally2.so 
 account    required   pam_access.so
 account    required   pam_nologin.so

(remove the highlighted lines!)

You can also remove /var/log/tallylog if it’s still present.

Bug report here: https://bugs.archlinux.org/task/67641

Solution: merge the pacnew,

4 Likes
2

Are you sure you haven’t accidentaly sudo rm -rf /etc/shadow ? :sweat_smile:

Thx for headsup! :+1:

2 Likes
3

I have updated pam in a VM, and login is OK.
I don’t have /etc/pam.d/system-login.pacnew, if that is what you are referring to.

4

i will see that on 3 systems now …

5

It might depend how old the installation is, and therefore how old the system-login file was?

6

It was probably from May.

1 Like
7

Mine was from… uh… 2017? :rofl:

2 Likes
8

OK, I’ll reboot my main machine now. If I never come here again, this is the reason! :crazy_face: :rofl:

2 Likes
9

It’s been an honour, and a pleasure, sir! Godspeed!

1 Like
10

That reboot was too easy… :wink:

2 Likes
11

Well, that was a bit anticlimactic… :neutral_face:

4 Likes
12

All is well here on plasma.

2 Likes
13

No problem on Cinnamon.
Installation yet to turn three weeks. :blush:

1 Like
14

Ah, I know why it’s not affecting most people - I must have edited the file at some point (something to do with cgfs…?), so pacman didn’t automatically replace it. Setting up e.g. a fingerprint reader would have the same effect.

If you’ve never edited the file then pacman will happily replace it without creating a pacnew.

Makes sense.

3 Likes
15

I wanted to react before, because I have an installation from late 2016 and I didn’t have any issues either with the pam update.

2 Likes
16

I can confirm that everything is kool* here on Plasma.

*joke with KDE on the receiving end (Kool Desktop Environment); I kid you not!). :smile:

3 Likes
17

After updating, I checked /etc/pam.d/system-login. The lines mentioning pam_tally2.so are gone without manual intervention.

18

Getting PAM systemd-homed errors on boot after PAM and SDDM update.

systemd[1108]: pam_systemd_home(systemd-user:account): Failed to query user record: Unit dbus-org.freedesktop.home1.service not found.
sddm-helper[1247]: pam_systemd_home(sddm:account): Failed to query user record: Unit dbus-org.freedesktop.home1.service not found.
systemd[1249]: pam_systemd_home(systemd-user:account): Failed to query user record: Unit dbus-org.freedesktop.home1.service not found.

Apparently they are benign, caused by the systemd-homed service not running. Doesn’t take into account if you don’t use systemd-homed.

https://bbs.archlinux.org/viewtopic.php?id=258297

Annoying to have so many errors on boot, benign or not.

EDIT :

Also getting sudo PAM errors referencing the non existent systemd-homed service.

sudo[2029]: pam_systemd_home(sudo:auth): Failed to query user record: Unit dbus-org.freedesktop.home1.service not found.
sudo[2029]: pam_systemd_home(sudo:auth): Failed to query user record: Unit dbus-org.freedesktop.home1.service not found.
sudo[2029]: pam_systemd_home(sudo:account): Failed to query user record: Unit dbus-org.freedesktop.home1.service not found.
sudo[2107]: pam_systemd_home(sudo:account): Failed to query user record: Unit dbus-org.freedesktop.home1.service not found.
sudo[2250]: pam_systemd_home(sudo:account): Failed to query user record: Unit dbus-org.freedesktop.home1.service not found.
sudo[2387]: pam_systemd_home(sudo:account): Failed to query user record: Unit dbus-org.freedesktop.home1.service not found.

Sudo commands working fine though, error message is also benign.

1 Like