https://bugs.kde.org/show_bug.cgi?id=465266
Bug ID: 465266
Summary: Cancelling the screen locker within the grace period
causes authentication failures (which may cause
account lockouts)
Classification: Plasma
Product: kscreenlocker
Version: 5.26.5
Platform: Archlinux
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: general
Assignee: plasma-b...@kde.org
Reporter: konrad.far...@gmail.com
Target Milestone: ---
SUMMARY
If the screen locker is cancelled within the configured grace period, it will
be registered by pam as an authentication failure. On some distos, 3 such
authentication failures will cause an unexpected 10-minute account lockout.
STEPS TO REPRODUCE
1. Enable automatic screen locking after 1 minute
2. Set the grace period ("Allow unlocking without password for: ") to a value
greater than zero
3. Wait for the screen locker
4. Move the mouse within the configured grace period to cancel the screen
locker
5. Open a terminal and run `journalctl -rt kscreenlocker_greet -b 0` (run as
root if needed)
OBSERVED RESULT
"authenitcation failure" is shown in the journal at the time when the screen
locker was cancelled, even though no attempt at authentication was made by the
user
EXPECTED RESULT
kscreenlocker should only try to authenticate the user after the grace period
has expired - no "authentication failure" message should be seen in the journal
if the screen locker was cancelled within the configured grace period
SOFTWARE/OS VERSIONS
Tested on two linux distributions:
1. Arch Linux (6.1.9-zen1-1-zen x86_64)
KDE Plasma Version: 5.26.5
KDE Frameworks Version: 5.102.0
Qt Version: 5.15.8
Graphics Platform: X11
2. KDE Neon Testing (5.15.0-58-generic x86_64)
KDE Plasma Version: 5.26.90
KDE Frameworks Version: 5.103.0
Qt Version: 5.15.8
Graphics Platform: X11
--
You are receiving this mail because:
You are watching all bug changes.
