Vncserver and login issue at the Lock Screen

Question

I am using vnc server for the first time on Ubuntu with gnome (Ubuntu 10.04.2 (lucid) with Gnome 2.30.2) and have a strange login issue. When I ran it the first time, I was asked to setup a password. I was subsequently able to connect to the :1.0 display from a VNC client after entering the password I setup earlier, and it seemed to work as I expected. The issue is that once the session times out and the Lock Screen is presented, I can no longer login. My regular Linux password gets rejected and I even tried the VNC password, just in case it gets setup differently here. This happens every single time, and I reproduced it multiple times. I am able to lock and unlock the session on the physical display monitor with no problem. Can anyone give me a clue on what might be going wrong here?

Solution

Your gnome session may be setup without privileges to access the password database. Check /var/log/auth.log for errors related to this.

See my answer to Best fullscreen solution for vnc on linux for some alternative configurations which should work with locking. Using xinetd to run VNC will drop your session if you disconnect. RDP allows you to disconnect and reconnect without loosing your session.

Comments

[haridsv]

Thanks for the tip, I will check auth.log. Will any native RDP client on linux allow a seamless fullscreen mode? My intention is to connect to the same session whether at office or home.

[BillThor]

The default viewer seems to do a good job. I haven't tried them all.

[haridsv]

I see messages of the sort: Apr 12 14:06:17 hdara-wsl adclient[1333]: ERROR <fd:21 gnome-screensav(22741)> Failure in list match for key 'pam.ignore.users' from file '/etc/centrifydc/centrifydc.conf': file does not exist It repeats for each of the keys nss.user.ignore, pam.ignore.users, nss.user.ignore, pam.ignore.users, pam.ignore.users, pam.ignore.users, nss.user.ignore, pam.ignore.users. There is also this one: Apr 12 14:06:21 hdara-wsl adclient[1333]: WARN <fd:22 PAMVerifyPassword> audit User 'xxx' not authenticated: bad password

[BillThor]

@haridsv: This indicates the password did not match for the user. You should be using the user's password, not the VNC password. It appears pam is able to check the password so you shouldn't need to modify the privileges of adclient.

[haridsv]

I did use the user password not vnc password, so not sure why it would not work. I didn't have this problem unlocking the xrdp session, so something is strange with the session created by vncserver.

[BillThor]

You might try making adclient client setuid root. It is possible it can't read /etc/shadow or wherever the passwords are stored. I have run into that problem when passwords are in LDAP.

[haridsv]

I will sure try that and report back in a couple of days.

[haridsv]

I had my OS reinstalled and my profile freshly setup, and I can no longer reproduce this issue, so I can't verify if your suggestion would solve the issue or not.

[sepehr]

I have the same problem, by any chance did you encounter the problem again and found the solution?