Kicksecure and LMDE, MX KDE and Sparky KDE / SDDM Problems

Support
22

It did not help. Both options did not fix problem. Sleep mode and sddm hanging remained

23

Alright, I didnā€™t manage to test the sleep mode stuff yet, but I managed to get SDDM to hang reliably. If you always type your password correctly, it works, but if you type your password wrong once, it will make SDDM hang every time you try to enter a password thereafter, regardless of whether that password is correct or not. The quickest way to fix it is to log in at a TTY, then immediately exit and then try logging in at SDDM again.

Can you test the following for me and see if it works to fix the issue?

  • Reinstall security-misc (sudo apt install security-misc)
  • Run sudo nano /etc/pam.d/common-auth
  • Comment out this line of the file (it should be the first line in the file that isnā€™t already a comment):
auth    optional        pam_exec.so debug stdout seteuid /usr/libexec/security-misc/pam-info
  • Press Ctrl+S to save, then Ctrl+X to close the file
  • Log out of KDE Plasma
  • Type a wrong password at the SDDM screen, wait for it to be rejected
  • Type another wrong password, this also should be rejected
  • Now type the right password, it should be accepted

If this works on your end, then at least part of the problem has been found - SDDM canā€™t handle the warning in Kicksecure about how many more times you can fail to enter the correct password before youā€™re locked out. If this is the case, itā€™s a bug in SDDM that will require some research to fix.

Going to test sleep and resume now, I should have tested that while I was still booted into Kicksecure but I forgot to.

2 Likes
24

Back from testing sleep, seems to work fine here, and KDEā€™s lock screen copes just fine with the lockout warnings from security-misc, so this is probably hardware-dependent. Also, this might not be a bug in SDDM itself, but might be a problem with Plasmaā€™s SDDM theme. Edit: Looks like itā€™s a problem in SDDM itself. Iā€™ve tried three different SDDM themes and they all break the same way.

Edit 2: More debugging underway. So far Iā€™ve concluded:

  • It is not a socket read failure within SDDM, or if it is, my workarounds didnā€™t work.
  • It definitely is a problem within SDDM, I can see valuable info about the issue in the journalctl logs and it isnā€™t theme-dependent.
  • I currently think SDDM is, for some unknown reason, failing to ever hand the password to PAM. It gets the user account handed over, it reads the warning about the risk of a lockout, and then it doesnā€™t seem to write the password (or if it does, itā€™s not finalizing something AFAICT). I think this because I can see SDDM is getting the lockout warning in the logs, but the lockout counter still only indicates one failed login even after trying to login with a bad password twice. So thatā€™s probably where Iā€™ll hunt for issues next.

I did check the upstream SDDM bugtracker to see if this was a known issue, and didnā€™t see anything about it. I should try to reproduce the issue with an updated version of SDDM, and try to come up with a minimal reproducible example.

1 Like
25

Yes. Thank you. I will test it on my laptop and on my friends computers

26

Maybe replace SDDM with Ligthdm in plasma?

27

You can actually choose LightDM rather than SDDM while kicksecure-xfce-host is installing - youā€™ll get a prompt asking you which one to use. Still, SDDM should work, so it would be nice if it did work.

1 Like
28

it worked! on all computers login works with correct or incorrect passwords.
I also tested with lightdm - result is also excellent.

but you are right - it did not solve sleep mode problem in kde plasma. even using lightdm did not solve sleep bug on my friends computers

2 Likes
29

So, I tested upstream SDDM and found that it did not have a problem with logging in even with the information messages from security-misc. I then stared at the code for a while and couldnā€™t figure out what changed to make things work, so I bisected the code instead and found the patch that fixes the issue. I then tested it against Debianā€™s version of SDDM, and sure enough, it works. So Iā€™m going to get a bug reported and try to get a fix ā€œin flightā€.

1 Like
30

Bug reported to Debian with fix attached. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1089004

2 Likes
31

Thank you very much, friend!

I tested LMDE again and could not reproduce old error (endless login-password request). My friend had this error before latest security-misc updates, then he uninstalled Mint and installed MX KDE. Cinnamon works with Kicksecure without bugs now.
Now we just have to wait for the SDDM problems to be fixed.

I think this topic can be rename - for example, ā€œKicksecure and LMDE, MX KDE and Sparky KDE / SDDM Problemsā€. So that users can find it in search.

1 Like
32

by the way, I forgot to say - when installing Kicksecure on MX Linux xfce, there will be a conflict with security-misc and mx-xfce-desktop. just remove it
sudo apt remove mx-xfce-desktop
I have not noticed that it has affected work of MX xfce