Can't become sudo sometimes, password not accepted

[naxels]

System details

Omarchy v2.1.1, Linux 6.16.5-arch1-1, Hyprland 0.50.1 (Wayland), NVIDIA 3080, Logitech MX S keyboard (numlock on), sudo 1.9.17.p1-1

What's wrong?

I have the strangest issue sometimes, very randomly (not on every boot for example and can't seem to reproduce the issue)
Happened 3 times now in the course of ~ 2.5 weeks (I never leave the PC on for a long period of time)

However when I want to sudo, the terminal / popup doesn't accept my password,
whether I use: Ghostty (my default), Alacritty, Omarchy update via the menu (popup uses Alacritty)..

Even typing my password in Waybar or a text editor/Terminal and copy/then paste it, doesn't accept it, while I know it's correct.

Doing a reboot always fixes the issue...

The 3rd time I was also somehow able to magically fix the issue after starting VSCode and start the default terminal in there (seems to be Alacritty as well), then sudo su. afterwards sudo worked again everywhere (confirming that my password is actually correctly typed / pasted).
I don't know whether this actually has anything to do with VSCode and starting a separate terminal emulator or that maybe waiting long enough (was about 10mins) fixed the issue.

Don't know whether this is an Arch issue, Hyprland issue, Omarchy issue or something else,
anybody have any ideas / experienced this?

Thank you!

ps: I don't have a fingerprint reader and the Logitech MX S is connected via the Bolt receiver

---

journalctl --user doesn't show much info either:

when it fails:

Sep 10 16:13:42 omarchy unix_chkpwd[7133]: password check failed for user (naxels)

and when it succeeded later after running sudo su again successfully with same password I was using all the time

Sep 10 16:26:56 omarchy su[11529]: (to root) root on pts/1

[dhh]

Try running omarchy-reset-sudo next time you see this. I think we have a problem with the sudo error counter persisting. You get 10 total attempts in a running session, and when you're out of attempts, you're out.

It should be such that a single SUCCESSFUL attempt at sudo resets the counter, but I don't think that's happening at the moment. Please do investigate what might be causing this!

[naxels]

I tried getting to 10 failed logins and here is the message

Terminal:

sudo: 10 incorrect password attempts

journalctl -f

Sep 11 09:55:29 omarchy sudo[33666]: pam_faillock(sudo:auth): Consecutive login failures for user naxels account temporarily locked
Sep 11 09:55:32 omarchy sudo[33666]:   naxels : 10 incorrect password attempts ; TTY=pts/2 ; PWD=/home/naxels ; USER=root ; COMMAND=/usr/bin/su

After searching through the logs with journalctl it seems that I've hit this lock before, even though I haven't myself consciously mistyped the login that many times.

I can't find the '10 incorrect password attempts' message in journalctl, however can find the 'Consecutive login failures' 3x as I recalled above.

Very interesting, maybe a combination of commands (I have this habit of updating regularly and work in the Terminal all the time) might over time trigger this lockout issue..

The omarchy-reset-sudo worked :), it accepted my password and then shows this in the journalctl -f log:

Sep 11 10:00:56 omarchy su[34158]: (to root) naxels on pts/2
Sep 11 10:00:56 omarchy su[34158]: pam_unix(su:session): session opened for user root(uid=0) by naxels(uid=1000)
Sep 11 10:00:56 omarchy su[34158]: pam_unix(su:session): session closed for user root

[naxels]

Attached are the logs from the 1st and 2nd time this happened.

Maybe tzupdate or snapper have something to do with this, strange..

(somehow the log copy/paste gets cut off after X nr of characters so had to use files)

lockout-first.txt

lockout-second.txt

[apfernandes]

I am having a similar issue. Randomly after the screen locks my password is not accepted. I can ssh to the machine (private key) but I cannot log in or execute a command with sudo.

`Sep 11 11:57:01 omarchy-apf unix_chkpwd[33786]: password check failed for user (apf)

Sep 11 11:57:01 omarchy-apf sudo[33784]: pam_unix(sudo:auth): authentication failure; logname=apf uid=1000 euid=0 tty=/dev/pts/4 ruser=apf rhost= user=apf`

journalctl --since today

journalctl_output.txt

Between these random lockouts and Hyprland lockscreen crashes my experience has not been great.
It's a brand new install on a brand new Beelink EQR5 AMD Ryzen™ 7 5825U/5650U

[apfernandes]

I am having a similar issue. Randomly after the screen locks my password is not accepted. I can ssh to the machine (private key) but I cannot log in or execute a command with sudo.

`Sep 11 11:57:01 omarchy-apf unix_chkpwd[33786]: password check failed for user (apf)

Sep 11 11:57:01 omarchy-apf sudo[33784]: pam_unix(sudo:auth): authentication failure; logname=apf uid=1000 euid=0 tty=/dev/pts/4 ruser=apf rhost= user=apf`

journalctl --since today

journalctl_output.txt

Between these random lockouts and Hyprland lockscreen crashes my experience has not been great. It's a brand new install on a brand new Beelink EQR5 AMD Ryzen™ 7 5825U/5650U

I left the machine locked overnight (still not being able to log in) and when I arrived in the morning, without a reboot, I managed to log in again. As I was writing this, trying to come up with reproducible steps, I am locked again out of nowhere. It does not have to do with the 10 attempts, I am nowhere near that.

[apfernandes]

I am having a similar issue. Randomly after the screen locks my password is not accepted. I can ssh to the machine (private key) but I cannot log in or execute a command with sudo.
Sep 11 11:57:01 omarchy-apf unix_chkpwd[33786]: password check failed for user (apf) Sep 11 11:57:01 omarchy-apf sudo[33784]: pam_unix(sudo:auth): authentication failure; logname=apf uid=1000 euid=0 tty=/dev/pts/4 ruser=apf rhost= user=apf
journalctl --since today
journalctl_output.txt
Between these random lockouts and Hyprland lockscreen crashes my experience has not been great. It's a brand new install on a brand new Beelink EQR5 AMD Ryzen™ 7 5825U/5650U

I left the machine locked overnight (still not being able to log in) and when I arrived in the morning, without a reboot, I managed to log in again. As I was writing this, trying to come up with reproducible steps, I am locked again out of nowhere. It does not have to do with the 10 attempts, I am nowhere near that.

I managed to do a few more tests. I can get the account temporarily locked if I hit the 10 failed passwords and it shows up on the systemd journal

Sep 12 16:03:26 omarchy-apf hyprlock[5992]: pam_faillock(hyprlock:auth): Consecutive login failures for user apf account temporarily locked

I can unlock it by becoming root with the command

faillock --user apf --reset

The other times that I got locked out of the account I never found the "temporarily locked" message.

[apfernandes]

@dhh I think I can reproduce it but i'll be damned if I know what is going on. I have been going through the logs like crazy but can't put a finger on it. Here are the steps.

• Reboot
• Log in - no issue
• Lock screen
• SSH into the machine from another machine
• From that SSH session do a sudo command and enter the incorrect password
• Now back to our machine on the Hyprlock UI once prompted for the password just hit return (no password), do that 3 times
• After the 3rd time enter an incorrect password and the account will be locked

After this happens it can be unlocked from a root user with the command

sudo faillock --user apf --reset

However from this point on, if you answer return 3 times in a row instead of entering the password it will become locked.

It seems that it is defaulting to the 3 attempts for incorrect password. For some reason the failed sudo command from the terminal could be changing the maximum attempts number to 3?

Why was this happening to me randomly? Because my screen would go to sleep and I would wake up the machine by repeatedly hitting "return" unknowingly locking it after 3 attempts.

---

Edit - no need to ssh from another machine, a failed sudo command on a terminal window and then locking will do the "trick"

Edit II - I got it, it has to do with /etc/pam.d/sudo configuration, not sure if that is the desired choice or if it should be centralized in /etc/security/faillock.conf which is currently fully commented

[naxels]

Just saw this new added issue: #1622, it might help..

[naxels]

Don't know if anything changed, but haven't experienced this issue in a while i just noticed 😊

[llevering]

Well I have to run omarchy-reset-sudo now almost every hour. When I have to unlock hyprlock it doesn't work most of the time and I have to do a hard reset, as I don´t have ssh access to my machine.

[naxels]

Very interesting, what do the logs say?
I never SSH into my machine and don't seem to have the issue anymore
Also, which Omarchy version etc are you running?

[llevering]

Omarchy 3.02 (fresh install, only reusing my old /home partition from Ubuntu)

I can confirm that faillock --user $user --reset works.

Journalctl logs is full of:
Omarchy 3.02 (fresh install, only reusing my old /home partition from Ubuntu)

I can confirm that faillock --user $user --reset works.

Journalctl logs is full of:

Oct 01 21:44:43 Laptop sudo[5462]: pam_unix(sudo:auth): conversation failed
Oct 01 21:44:43 LL-Legion5 sudo[5462]: pam_unix(sudo:auth): auth could not identify password for [llevering]
Oct 01 21:44:50 LL-Legion5 sudo[5465]: pam_unix(sudo:auth): conversation failed
Oct 01 21:44:50 LL-Legion5 sudo[5465]: pam_unix(sudo:auth): auth could not identify password for [llevering]
Oct 01 21:44:58 LL-Legion5 sudo[5482]: pam_unix(sudo:auth): conversation failed
Oct 01 21:44:58 LL-Legion5 sudo[5482]: pam_unix(sudo:auth): auth could not identify password for [llevering]

But the question is where do these come from it is not that I so often mistype my password. I keep on investigating

Tried this as well (thnx @naxels), but to no avail:
#1571 (comment)

It is quite possible it is related to using my old /home, but haven´t been able to identify what would be causing the issue yet.

[llevering]

Found the culprit in my config! I have a script setup for Waybar to my Wireguard status. That uses sudo wg show. I defined in my sudoers file that sudo wg show should not request and a password and thus work from waybar, however something must be wrong there. Now I don't have pam_unix(sudo: auth) errors anymore. So completely user error.

Hope this helps someone if they have similar problems in the future! And thnx for the help @naxels and @apfernandes (for posting helpful information earlier).

[krax0x]

In my case this happened twice, each time while updating the system and continue working and left the window open. Probably asked me couple of times for the password? If that helps for the investigation of the root cause of this issue.