[kscreenlocker] [Bug 465266] Cancelling the screen locker within the grace period causes authentication failures (which may cause account lockouts)

[Colin J Thomson]

https://bugs.kde.org/show_bug.cgi?id=465266

--- Comment #1 from Colin J Thomson <colin.thom...@g6avk.co.uk> ---
On Saturday, 4 February 2023 11:27:56 GMT bugzilla_nore...@kde.org wrote:
> https://bugs.kde.org/show_bug.cgi?id=465266
> 
>             Bug ID: 465266
>            Summary: Cancelling the screen locker within the grace period
>                     causes authentication failures (which may cause
>                     account lockouts)
>     Classification: Plasma
>            Product: kscreenlocker
>            Version: 5.26.5
>           Platform: Archlinux
>                 OS: Linux
>             Status: REPORTED
>           Severity: normal
>           Priority: NOR
>          Component: general
>           Assignee: plasma-b...@kde.org
>           Reporter: konrad.far...@gmail.com
>   Target Milestone: ---
> 
> SUMMARY
> If the screen locker is cancelled within the configured grace period, it
> will be registered by pam as an authentication failure. On some distos, 3
> such authentication failures will cause an unexpected 10-minute account
> lockout.
> 
> 
> STEPS TO REPRODUCE
> 1. Enable automatic screen locking after 1 minute
> 2. Set the grace period ("Allow unlocking without password for: ") to a
> value greater than zero
> 3. Wait for the screen locker
> 4. Move the mouse within the configured grace period to cancel the screen
> locker
> 5. Open a terminal and run `journalctl -rt kscreenlocker_greet -b 0` (run as
> root if needed)
> 
> OBSERVED RESULT
> "authenitcation failure" is shown in the journal at the time when the screen
> locker was cancelled, even though no attempt at authentication was made by
> the user
> 
> EXPECTED RESULT
> kscreenlocker should only try to authenticate the user after the grace
> period has expired - no "authentication failure" message should be seen in
> the journal if the screen locker was cancelled within the configured grace
> period
> 
> SOFTWARE/OS VERSIONS
> Tested on two linux distributions:
> 1. Arch Linux (6.1.9-zen1-1-zen x86_64)
> KDE Plasma Version: 5.26.5
> KDE Frameworks Version: 5.102.0
> Qt Version: 5.15.8
> Graphics Platform: X11
> 2. KDE Neon Testing (5.15.0-58-generic x86_64)
> KDE Plasma Version: 5.26.90
> KDE Frameworks Version: 5.103.0
> Qt Version: 5.15.8
> Graphics Platform: X11

-- 
You are receiving this mail because:
You are watching all bug changes.