I enter my password, and it tells me that I “need to change my password immediately”. It won’t let me use my account, unless I type in a new password or enter the old password 10 times or so.
After repeatedly entering the old password, it will eventually unlock my screen. However, the system date increases by a few hundred years and wifi stops working. Everything turns back to normal after rebooting.
This hasn’t happened for a while now, but it used to happen every few weeks. I find it really strange, both the system date and wifi bug, and the fact that I am demanded to change my password.
Did this happen to anyone else, and does anyone know what and who might have caused this? I am curious.
(The distro is debian 12 and the lock-screen/desktop-environment is GNOME 43.6)
I’ve never had a linux setup demand that I change my password. Is this a feature of gnome?
Gnome is a desktop environment
You can configure password policies, but they’re usually not enabled by default.
It seems plausible that a bad date is expiring your password depending on your policy and configuration. Are you getting time from ntp? If so what server, and what is it saying? What does your bios show for time?
I am not familiar with ntp, I didn’t really change any date/time related settings or install any additional software. Also I suspect the BIOS to not be affected, since the date will be normal again after rebooting.
On my system it is called “Network Time”, but it might be called “Get current time from the internet” or something on other distros. Might be worth turning it off to see if it fixes things - maybe something on your network is sending incorrect time information?
The only setting I can find in my settings panel is automatic detection of my timezone, but that is turned off. Also, I have checked the time in my BIOS, and It’s only off by one hour.
Seems that this is not a common problem, I will probably go with @Strit’s advice and just hope that a reinstall will take care of things (Also, “maybe something on your network is sending incorrect time information” worries me in the same way as @Strit’s comment 😅️)
It seems like everyone else has beaten the clock thing to death, but I just want to throw in my two cents. I have worked on NTP in the past and anytime there was a bug that set the time wrong, all hell broke loose with general usability of the client system.
If you’re using Debian and haven’t like, intentionally installed a bunch of shady stuff, malware is pretty unlikely.
Double check how/where your time is being set. Try turning off any automatic adjustments and see what happens for a little while.
Agreed. I just finished reinstalling the operating system 👍
If the clock is off (bad CMOS battery, as others have noted); and there is a password “max age” setting that’s intended to be far, far, far in the future…
Well, your clock being off by a few hundred years might well trigger the (intended never) expiration setting.
Malware is a possibility, but I lean towards the date being the cause rather than an effect.
I did go into the BIOS earlier and it showed the correct time (just one hour off). Is this the clock that you are talking about or is there another clock that I should check? (sorry I don’t really know much about this stuff)
When you power the system down, unplug it from the wall for ~10 minutes, plug it back in, then power it back up, is the BIOS clock off by an hour again? If so, I’d follow the recommendation to replace the CMOS battery. If you look your motherboard up online, you should be able to find the location on the board and type of battery. It isn’t a complicated task, but it can seem difficult if you’ve never done it before.
The clock likely is off by an hour because of local time vs UTC difference. Where the BIOS is set to UTC.
Linux generally stores the time in BIOS as UTC then adjusts to the local timezone on the fly. Windows just stores it as the local timezone, which can create interesting behavior when dualbooting sometimes
Also hold down the power button for a few seconds after unplugging just to help drain out any residual power from capacitors.
Also if it is a laptop or other battery-operated device you will want to disconnect the batter temporarily.
Ok thanks, I will try that
That’s the one I had in mind.
Does this happen immediately after booting? How old is the system?
I’m wondering if the clock circuitry in the motherboard might be busted or have low battery.
I only remember this happening after locking my screen and later trying to unlock the screen again
Not sure if it’s clock related. I had a Debian 12 on a server that had a empty CMOS battery, and it didn’t do anything like that
It depends. Some hardware degrades gracefully while my current desktop system won’t even boot and throws error codes on an empty battery. It took me hours to figure out what was wrong the first time it happened.
I might be a bit paranoid here, but I would just re-install the system. Could be some malicious stuff at work here.
I was going to reinstall soon to setup full disk encryption anyways. That is why I wanted to figure this out first. If this is a bug that can be fixed, then I will stay with debian and GNOME. If it is a design choice to regularly ask users to change their passwords, and it can’t be easily toggled off, I will have to look at other distros and/or desktop-environments
It looks like a bug in the malware, to be honest. I’d backup sensitive data and scrub the disk, while booting from a GParted live USB.
What you are describing has never happened to me in the 8 years I’ve used Linux.
You may want to fully test your RAM with memtest while you’re at it. Especially if you’re going to be using encryption.
This sounds like a corrupt system. Run a RAM check and do a fresh install.
Certainly not a computer expert, but consider the option that the battery on your motherboard might be running low. If the hardware itself is older, I would try swapping the button cell. I’ve seen many weird issues get resolved this way, although in theory it should not mess up anything but system time.
although in theory it should not mess up anything but system time.
Yes, I can’t see why this would explain my computer suddenly demanding that I must change my password, which is what I am most interested to know the reason for.
Linux passwords can be set to expire. A non-expiring password is sometimes just set to expire so far in the future that it will not be reached by the user (such as 100 or 200 years). A really broken clock could surpass that and cause expiry.
I was thinking potentially if the system thinks the password was set 200 years in the future it would also be invalid
