0

Probably after changing hostname using settings or removing cryptswap, but I have also updated /etc/hosts:

127.0.0.1 localhost
::1 localhost
127.0.1.1 pop2104.localdomain     pop2104

There's no error message, it just keeps asking for my password again and again (like the password is wrong).

# from journalctl -r
Nov 08 13:07:34 pop2104 sudo[8413]: pam_unix(sudo:auth): auth could not identify password for [asd]
Nov 08 13:07:34 pop2104 sudo[8413]: pam_unix(sudo:auth): conversation failed

Nov 08 13:09:14 pop2104 sudo[9093]: pam_unix(sudo:auth): Couldn't open /etc/securetty: No such file or directory

# from /etc/passwd
asd:x:1000:1000:ASD:/home/asd:/usr/bin/zsh

I'm sure the password is correct, because when unlocking the keyring it works fine.

I am using PopOS 21.04.

4
  • 1
    That /etc/hosts file looks wrong - protocols like https have no place there.
    – Panki
    Nov 8, 2021 at 8:18
  • Couldn't open /etc/securetty doesn't look good. This file is (on my system) world readable so the message implies you've deleted the file or changed the permissions...? Nov 8, 2021 at 9:31
  • Have you changed any of the PAM files in /etc/pam.d? Nov 8, 2021 at 9:51
  • oh that http is because of copy pasting from reddit XD, lemme edit that @Panki
    – Kokizzu
    Nov 8, 2021 at 12:03

3 Answers 3

1

The /etc/hosts must be in format:

127.0.0.1 localhost
::1 localhost
127.0.1.1 pop2104.localdomain     pop2104

No protocols, no brackets

1

The error messages suggest the PAM authentication module pam_unix.so "could not identify password" for the user. That might mean your /etc/shadow is somehow corrupted.

Try running pwck as root. It will typically output some messages about some system accounts not having a valid home directory: that is normal and can be ignored. But does it say anything about user asd?

The other error message indicates /etc/securetty is missing. Some Linux distributions consider /etc/securetty to be no longer useful, while others still have it. Apparently PopOS expects it to be there.

If it has vanished with no apparent reason, then your system may have been (poorly) hacked: the intruder may have been trying to use some exploit to remove /etc/securetty and to inject an extra entry to /etc/shadow, but it seems the presumed injection attempt to /etc/shadow may have been less than successful, if it has broken the file format.

0

After restarting, booting rescue drop to root user, and then passwd asd, it can sudo now.

2
  • What, you mean there originally wasn't a password for asd at all? Nov 8, 2021 at 14:12
  • @roaima there is, but suddenly I can't sudo anymore with old password, resetting to new password with the same value as old password btw
    – Kokizzu
    Nov 8, 2021 at 18:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .