2

I am seeing the following errors:

$ journalctl -b -p3
-- Logs begin at Mon 2016-05-16 21:40:56 EDT, end at Wed 2016-07-27 22:30:13 EDT. --
Jul 27 22:22:26 x99 kcheckpass[5682]: pam_tally(kde:auth): Error opening /var/log/faillog for update
Jul 27 22:22:26 x99 kcheckpass[5682]: pam_tally(kde:auth): Error opening /var/log/faillog for read
Jul 27 22:22:26 x99 kcheckpass[5682]: pam_tally(kde:auth): Error opening /var/log/faillog for update
Jul 27 22:22:26 x99 kcheckpass[5682]: pam_tally(kde:auth): Error opening /var/log/faillog for read
Jul 27 22:22:26 x99 kcheckpass[5682]: pam_tally(kde:setcred): Error opening /var/log/faillog for update
Jul 27 22:22:26 x99 kcheckpass[5682]: pam_tally(kde:setcred): Error opening /var/log/faillog for update

The man page for kcheckpass says:

kcheckpass - KDE's authentication program

Any program, such as a screensaver with a lock option, that needs to authenticate a user, can use kcheckpass. kcheckpass is a simple setuid program that returns 0 if the user has been authenticated, and 1 if not. Other programs that need user authentication can use kcheckpass witout having setuid status, thus simplifying programs and enhancing system security.

SECURITY
kcheckpass must be setuid on systems that use shadow passwords.

I understand that the setuid permission bit tells Linux to run a program with the effective user id of the owner instead of the executor.

However, I do not understand how to implement the solution in this case. What exactly do I need to do?

Here are the existing permissions on /var/log/faillog

$ ls -la /var/log/faillog 
-rw------- 1 root root 32096 Aug  9 12:56 /var/log/faillog
Improve this question

2 Answers 2

Reset to default
1

From the Arch Linux forum, there is a better answer:

Edit this file and make the 2 changes stated below (remove a line and insert a new line):

sudo nano /etc/pam.d/system-login

Remove this entire line:

auth       required   pam_tally.so         onerr=succeed file=/var/log/faillog

Insert in its place this line:

auth       required   pam_tally2.so

Create the log file:

touch /var/log/tallylog
chmod 600 /var/log/tallylog

See more details at the Arch Forum for an explanation of why this may be the better solution.

Improve this answer
0

You can run this command:

sudo chmod +s /usr/lib/kcheckpass

Depending on the distro you are using it could be located in another directory, so it could be /usr/libexec/kcheckpass.

Improve this answer
2
  • Could you elaborate on what this does and how it fixes the problem? I understand your command will make the kcheckpass program run as the file's owner instead of the user who invoked it. This solution depends on some knowledge of what the owner of kcheckpass and /var/log/faillog which is not stated. Why is this a better solution than changing the ownership or permissions of /var/log/faillog? I would think it isn't.
    – EricS
    Commented Jan 17, 2018 at 19:22
  • As the original question stated, kcheckpass was meant to be run with SUID so it had the proper permissions to perform its tasks. This may have changed since the kcheckpass rewrite (more information here blog.martin-graesslin.com/blog/2017/05/… unless you're seeing this issue I wouldn't bother to change it to SUID unless you are seeing any issues. When I was seeing this error in my log I was also having login issues as well, so the messages were indicative of a larger issue.
    – Samantha M.
    Commented Jan 19, 2018 at 9:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .