Peculiar password problem
June 11, 2014 10:36 AM Subscribe
The OS X GUI—but only the GUI—has stopped accepting my password. Any password.
I have a late-2009 iMac running OS X 10.9.2. The other night, I tried to install something that asked for my administrator password. When I entered it, the dialog box did the little “nope, wrong password” wiggle. This was a sudden development: I’d entered that password without incident several times that day. I tried again a few times and got the same response, so I shrugged, saved my files, and restarted the computer.
When the flat grey login screen came up, it wouldn’t accept my password either. After three failed attempts, it offered to let me use my Apple ID to reset the password. That seemed to work, but when it tried to use my newly-reset password to automatically log in, it was rejected again. I reset it again, to a completely different password. Same problem.
Here’s where it gets weird. I put the Mac into console mode (username >console, blank password) and tried to log in that way—and it worked! I tried to SSH in from my laptop. That worked too. And
While I know it’s best practice to have a separate admin account, I’m ashamed to say I don’t have any other users set up on this computer, so I can’t test whether this problem is limited to my account.
I’d call myself an intermediate nerd: I’m comfortable at the command line, and I can write a mean shell script. But I don’t even know where to begin troubleshooting this. Thanks in advance for your help!
I have a late-2009 iMac running OS X 10.9.2. The other night, I tried to install something that asked for my administrator password. When I entered it, the dialog box did the little “nope, wrong password” wiggle. This was a sudden development: I’d entered that password without incident several times that day. I tried again a few times and got the same response, so I shrugged, saved my files, and restarted the computer.
When the flat grey login screen came up, it wouldn’t accept my password either. After three failed attempts, it offered to let me use my Apple ID to reset the password. That seemed to work, but when it tried to use my newly-reset password to automatically log in, it was rejected again. I reset it again, to a completely different password. Same problem.
Here’s where it gets weird. I put the Mac into console mode (username >console, blank password) and tried to log in that way—and it worked! I tried to SSH in from my laptop. That worked too. And
sudo accepted my password just fine. But when I exited to the GUI login screen, I was back to password non grata.While I know it’s best practice to have a separate admin account, I’m ashamed to say I don’t have any other users set up on this computer, so I can’t test whether this problem is limited to my account.
I’d call myself an intermediate nerd: I’m comfortable at the command line, and I can write a mean shell script. But I don’t even know where to begin troubleshooting this. Thanks in advance for your help!
My first thought was caps lock or number lock was on or off, whichever one you don't expect it to be.
posted by rabbitrabbit at 10:55 AM on June 11, 2014
posted by rabbitrabbit at 10:55 AM on June 11, 2014
If you can get to the console, and sudo works, then can you create a new user from the command line and test the GUI with that new user?
posted by jozxyqk at 10:58 AM on June 11, 2014
posted by jozxyqk at 10:58 AM on June 11, 2014
We once had a somewhat similar problem to this at my office. It turned out that the person had previously paired a wireless keyboard to his machine, but wasn't using it any more. The keyboard was sitting in a corner on someone else's desk. Somehow it got turned on, and it was still in range, so it connected to the original user's computer. It had a bunch of junk piled on it, which caused it to constantly send a stream of spaces, which was very baffling until we figured out what was happening. I could see a similar thing happening with shift or caps lock, which would be less immediately visible, but could cause problems like this.
posted by primethyme at 11:31 AM on June 11, 2014
posted by primethyme at 11:31 AM on June 11, 2014
Never seen this on the particular issue, but keychain first aid? Although I think that might need the admin password...
posted by mhz at 11:43 AM on June 11, 2014
posted by mhz at 11:43 AM on June 11, 2014
Response by poster: There is no wireless keyboard connected to this computer. I used the same USB keyboard to (successfully) enter my password at the command line as I did to (unsuccessfully) enter it in the GUI.
Apple keyboards don't have a Num Lock key, and yes, I made sure Caps Lock was off.
I'll try creating a new user and see if that works.
posted by Zozo at 11:51 AM on June 11, 2014
Apple keyboards don't have a Num Lock key, and yes, I made sure Caps Lock was off.
I'll try creating a new user and see if that works.
posted by Zozo at 11:51 AM on June 11, 2014
Watch your language!. I mean did you at one point accidentally change the language setting of the keyboard? That could mess with keyboard layout. Some preboot authorization programs ( Like PGP) won't work until the keyboard is set to match the layout/language of the original password.
posted by Gungho at 12:53 PM on June 11, 2014 [2 favorites]
posted by Gungho at 12:53 PM on June 11, 2014 [2 favorites]
when it tried to use my newly-reset password to automatically log in, it was rejected again
Perhaps the system and/or login components of your Keychain are corrupt? If there's any way to get to the GUI via another account, you might first give Apple's Keychain First Aid a try, via the Keychain Access utility.
If you have a backup and can get to root via CLI, you could also run the command-line equivalent to list keychains, e.g.:
$ security list-keychains
"/Users/foo/Library/Keychains/login.keychain"
"/Users/foo/Library/Keychains/Microsoft_Intermediate_Certificates"
"/Library/Keychains/System.keychain"
You could rename the login.keychain, then do touch /Users/.../login.keychain to create an empty file. Then try logging in to your old account again, in order to repopulate a fresh login.keychain. If this fails, because you renamed the original file, you can cp it back to its original location.
You might also wipe the System.keychain file. To create a fresh System.keychain you could use /usr/sbin/systemkeychain -C -f when logged in as root. I don't think you can just delete this, as it relies on another file for validation.
Setting up fresh keychain files may force setting up authenticated services again, once you're logged in.
Once again, make sure you have a backup before you do any manipulations of these core files.
posted by Blazecock Pileon at 2:24 PM on June 11, 2014
Perhaps the system and/or login components of your Keychain are corrupt? If there's any way to get to the GUI via another account, you might first give Apple's Keychain First Aid a try, via the Keychain Access utility.
If you have a backup and can get to root via CLI, you could also run the command-line equivalent to list keychains, e.g.:
$ security list-keychains
"/Users/foo/Library/Keychains/login.keychain"
"/Users/foo/Library/Keychains/Microsoft_Intermediate_Certificates"
"/Library/Keychains/System.keychain"
You could rename the login.keychain, then do touch /Users/.../login.keychain to create an empty file. Then try logging in to your old account again, in order to repopulate a fresh login.keychain. If this fails, because you renamed the original file, you can cp it back to its original location.
You might also wipe the System.keychain file. To create a fresh System.keychain you could use /usr/sbin/systemkeychain -C -f when logged in as root. I don't think you can just delete this, as it relies on another file for validation.
Setting up fresh keychain files may force setting up authenticated services again, once you're logged in.
Once again, make sure you have a backup before you do any manipulations of these core files.
posted by Blazecock Pileon at 2:24 PM on June 11, 2014
Do you have the computer set up for multiple languages / keyboard layouts? I use both Dvorak and QWERTY, and sometimes certain OS password panels will have a different keyboard selected. In some situations the panel has a menu tucked away in a corner where you can change the keyboard, but I've also seen situations where that isn't the case and you just have to guess and try the other keyboard.
(This is basically a longer version of what Gungho suggested.)
posted by alms at 8:09 PM on June 11, 2014
(This is basically a longer version of what Gungho suggested.)
posted by alms at 8:09 PM on June 11, 2014
Response by poster: Thanks for the suggestion, Blazecock Pileon, but I'm afraid it didn't work. I created a new user as well, and I can't log in as that one, either.
I can also confirm that the keyboard layout is standard and the password I think I'm typing is actually, exactly, the password I am typing. The GUI side of the OS just doesn't seem to want to accept anything.
posted by Zozo at 8:52 PM on June 11, 2014
I can also confirm that the keyboard layout is standard and the password I think I'm typing is actually, exactly, the password I am typing. The GUI side of the OS just doesn't seem to want to accept anything.
posted by Zozo at 8:52 PM on June 11, 2014
You could reinstall the OS, perhaps trying an Archive and Install to preserve as many settings as possible, while getting a fresh OS installation.
posted by Blazecock Pileon at 9:30 PM on June 11, 2014
posted by Blazecock Pileon at 9:30 PM on June 11, 2014
Best answer: Well, I eventually figured out the problem, and thought I should come back and mark this resolved.
Someone on StackExchange suggested I run
Anyway, I appreciate everyone's help. Thanks again.
posted by Zozo at 1:40 PM on July 10, 2014
Someone on StackExchange suggested I run
syslog from the console right after a failed login attempt, and when I did, I discovered the culprit immediately: a PAM module I'd installed a few weeks earlier and hadn't configured properly. I don't know why it took so long to start causing problems, but disabling the module fixed everything immediately. (I didn't even have to reboot!)Anyway, I appreciate everyone's help. Thanks again.
posted by Zozo at 1:40 PM on July 10, 2014
This thread is closed to new comments.
posted by carsonb at 10:53 AM on June 11, 2014 [1 favorite]