init system is openrc
I created different user and can log in with it.
I moved homedir for my main user and created empty one, still - can not login.
Just in case to test if my .zshrc/.profile are messed up.
I changed user shell to sh with no effect (and with empty homedir), the message changed, now it is:
-sh: error while loading shared libraries: libncursesw.so.6: failed to map segment from shared object
$ pacman -Ss ^zsh\$
world/zsh 5.8.1-1 [installed]
A very advanced and programmable command interpreter (shell) for UNIX
extra/zsh 5.8.1-1 [installed]
A very advanced and programmable command interpreter (shell) for UNIX
$ pacman -Ss util-linux
system/util-linux 2.38-1 [installed]
Miscellaneous system utilities for Linux
system/util-linux-libs 2.38-1 [installed]
util-linux runtime libraries
multilib/lib32-util-linux 2.38-1 [installed]
Miscellaneous system utilities for Linux (32-bit)
# grep '^\[' /etc/pacman.conf
[options]
[system]
[world]
[galaxy]
[extra]
[community]
[multilib]
I have tried to log in with different users via ssh, here are snippets from audit.log, if that helps.
basilio:
type=CWD msg=audit(1649687788.719:13): cwd="/var/log/audit"
type=PATH msg=audit(1649687788.719:13): item=0 name="/usr/bin/tee" inode=4993695 dev=103:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PATH msg=audit(1649687788.719:13): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=4984184 dev=103:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=SYSCALL msg=audit(1649687788.719:14): arch=c000003e syscall=59 success=yes exit=0 a0=55b4ea091dc0 a1=55b4ea091630 a2=55b4ea091e00 a3=8 items=2 ppid=2865 pid=2906 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=3 comm="tail" exe="/usr/bin/tail" key=(null)ARCH=x86_64 SYSCALL=execve AUID="lyuba" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"
type=PROCTITLE msg=audit(1649687788.719:13): proctitle=74656500626173696C696F2E6C6F67
type=EXECVE msg=audit(1649687788.719:14): argc=3 a0="tail" a1="-f" a2="audit.log"
type=CWD msg=audit(1649687788.719:14): cwd="/var/log/audit"
type=PATH msg=audit(1649687788.719:14): item=0 name="/usr/bin/tail" inode=4993694 dev=103:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PATH msg=audit(1649687788.719:14): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=4984184 dev=103:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PROCTITLE msg=audit(1649687788.719:14): proctitle=7461696C002D660061756469742E6C6F67
type=SYSCALL msg=audit(1649687791.579:15): arch=c000003e syscall=59 success=yes exit=0 a0=55f781fee2f0 a1=55f7820153b0 a2=55f781fee370 a3=0 items=2 ppid=2541 pid=2908 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd" exe="/usr/bin/sshd" key=(null)ARCH=x86_64 SYSCALL=execve AUID="unset" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"
type=EXECVE msg=audit(1649687791.579:15): argc=5 a0="/usr/bin/sshd" a1="-f" a2="/etc/ssh/sshd_config" a3="-D" a4="-R"
type=CWD msg=audit(1649687791.579:15): cwd="/"
type=PATH msg=audit(1649687791.579:15): item=0 name="/usr/bin/sshd" inode=5011931 dev=103:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PATH msg=audit(1649687791.579:15): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=4984184 dev=103:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PROCTITLE msg=audit(1649687791.579:15): proctitle=2F7573722F62696E2F73736864002D66002F6574632F7373682F737368645F636F6E666967002D44002D52
type=USER_AUTH msg=audit(1649687796.039:16): pid=2908 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication grantors=pam_shells,pam_faillock,pam_permit,pam_faillock acct="basilio" exe="/usr/bin/sshd" hostname=172.30.40.21 addr=172.30.40.21 terminal=ssh res=success'UID="root" AUID="unset"
type=USER_ACCT msg=audit(1649687796.039:17): pid=2908 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_permit,pam_time acct="basilio" exe="/usr/bin/sshd" hostname=172.30.40.21 addr=172.30.40.21 terminal=ssh res=success'UID="root" AUID="unset"
type=CRED_ACQ msg=audit(1649687796.043:18): pid=2908 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_shells,pam_faillock,pam_permit,pam_faillock acct="basilio" exe="/usr/bin/sshd" hostname=172.30.40.21 addr=172.30.40.21 terminal=ssh res=success'UID="root" AUID="unset"
type=LOGIN msg=audit(1649687796.043:19): pid=2908 uid=0 old-auid=4294967295 auid=1000 tty=(none) old-ses=4294967295 ses=6 res=1UID="root" OLD-AUID="unset" AUID="basilio"
type=SYSCALL msg=audit(1649687796.043:19): arch=c000003e syscall=1 success=yes exit=4 a0=3 a1=7fff85b39120 a2=4 a3=0 items=0 ppid=2541 pid=2908 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=6 comm="sshd" exe="/usr/bin/sshd" key=(null)ARCH=x86_64 SYSCALL=write AUID="basilio" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"
type=PROCTITLE msg=audit(1649687796.043:19): proctitle=737368643A20626173696C696F205B707269765D
type=USER_START msg=audit(1649687796.043:20): pid=2908 uid=0 auid=1000 ses=6 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_unix,pam_permit,pam_mail,pam_elogind,pam_env acct="basilio" exe="/usr/bin/sshd" hostname=172.30.40.21 addr=172.30.40.21 terminal=ssh res=success'UID="root" AUID="basilio"
type=CRED_ACQ msg=audit(1649687796.043:21): pid=2911 uid=0 auid=1000 ses=6 msg='op=PAM:setcred grantors=pam_shells,pam_faillock,pam_permit,pam_faillock acct="basilio" exe="/usr/bin/sshd" hostname=172.30.40.21 addr=172.30.40.21 terminal=ssh res=success'UID="root" AUID="basilio"
type=USER_END msg=audit(1649687796.046:22): pid=2908 uid=0 auid=1000 ses=6 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_unix,pam_permit,pam_mail,pam_elogind,pam_env acct="basilio" exe="/usr/bin/sshd" hostname=172.30.40.21 addr=172.30.40.21 terminal=ssh res=success'UID="root" AUID="basilio"
type=CRED_DISP msg=audit(1649687796.046:23): pid=2908 uid=0 auid=1000 ses=6 msg='op=PAM:setcred grantors=pam_shells,pam_faillock,pam_permit,pam_faillock acct="basilio" exe="/usr/bin/sshd" hostname=172.30.40.21 addr=172.30.40.21 terminal=ssh res=success'UID="root" AUID="basilio"
type=SYSCALL msg=audit(1649687796.046:24): arch=c000003e syscall=59 success=yes exit=0 a0=561a20d9d5b0 a1=561a20d9e9b0 a2=561a20d9e610 a3=8 items=2 ppid=2912 pid=2913 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="rmdir" exe="/usr/bin/rmdir" key=(null)ARCH=x86_64 SYSCALL=execve AUID="unset" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"
type=EXECVE msg=audit(1649687796.046:24): argc=2 a0="rmdir" a1="/sys/fs/cgroup/openrc//6"
type=CWD msg=audit(1649687796.046:24): cwd="/"
type=PATH msg=audit(1649687796.046:24): item=0 name="/bin/rmdir" inode=4993675 dev=103:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PATH msg=audit(1649687796.046:24): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=4984184 dev=103:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PROCTITLE msg=audit(1649687796.046:24): proctitle=726D646972002F7379732F66732F6367726F75702F6F70656E72632F2F36
user 'lyuba':
type=CWD msg=audit(1649687803.246:25): cwd="/var/log/audit"
type=PATH msg=audit(1649687803.246:25): item=0 name="/usr/bin/tee" inode=4993695 dev=103:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PATH msg=audit(1649687803.246:25): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=4984184 dev=103:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PROCTITLE msg=audit(1649687803.246:25): proctitle=746565006C797562612E6C6F67
type=SYSCALL msg=audit(1649687803.246:26): arch=c000003e syscall=59 success=yes exit=0 a0=55b4ea091dc0 a1=55b4ea0915c0 a2=55b4ea091e00 a3=8 items=2 ppid=2865 pid=2914 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=3 comm="tail" exe="/usr/bin/tail" key=(null)ARCH=x86_64 SYSCALL=execve AUID="lyuba" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"
type=EXECVE msg=audit(1649687803.246:26): argc=3 a0="tail" a1="-f" a2="audit.log"
type=CWD msg=audit(1649687803.246:26): cwd="/var/log/audit"
type=PATH msg=audit(1649687803.246:26): item=0 name="/usr/bin/tail" inode=4993694 dev=103:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PATH msg=audit(1649687803.246:26): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=4984184 dev=103:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PROCTITLE msg=audit(1649687803.246:26): proctitle=7461696C002D660061756469742E6C6F67
type=SYSCALL msg=audit(1649687809.923:27): arch=c000003e syscall=59 success=yes exit=0 a0=55f781fee2f0 a1=55f7820153b0 a2=55f781fee370 a3=0 items=2 ppid=2541 pid=2916 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd" exe="/usr/bin/sshd" key=(null)ARCH=x86_64 SYSCALL=execve AUID="unset" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"
type=EXECVE msg=audit(1649687809.923:27): argc=5 a0="/usr/bin/sshd" a1="-f" a2="/etc/ssh/sshd_config" a3="-D" a4="-R"
type=CWD msg=audit(1649687809.923:27): cwd="/"
type=PATH msg=audit(1649687809.923:27): item=0 name="/usr/bin/sshd" inode=5011931 dev=103:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PATH msg=audit(1649687809.923:27): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=4984184 dev=103:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PROCTITLE msg=audit(1649687809.923:27): proctitle=2F7573722F62696E2F73736864002D66002F6574632F7373682F737368645F636F6E666967002D44002D52
type=USER_AUTH msg=audit(1649687812.336:28): pid=2916 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:authentication grantors=pam_shells,pam_faillock,pam_permit,pam_faillock acct="lyuba" exe="/usr/bin/sshd" hostname=172.30.40.21 addr=172.30.40.21 terminal=ssh res=success'UID="root" AUID="unset"
type=USER_ACCT msg=audit(1649687812.336:29): pid=2916 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting grantors=pam_access,pam_unix,pam_permit,pam_time acct="lyuba" exe="/usr/bin/sshd" hostname=172.30.40.21 addr=172.30.40.21 terminal=ssh res=success'UID="root" AUID="unset"
type=CRED_ACQ msg=audit(1649687812.339:30): pid=2916 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=pam_shells,pam_faillock,pam_permit,pam_faillock acct="lyuba" exe="/usr/bin/sshd" hostname=172.30.40.21 addr=172.30.40.21 terminal=ssh res=success'UID="root" AUID="unset"
type=LOGIN msg=audit(1649687812.339:31): pid=2916 uid=0 old-auid=4294967295 auid=1001 tty=(none) old-ses=4294967295 ses=7 res=1UID="root" OLD-AUID="unset" AUID="lyuba"
type=SYSCALL msg=audit(1649687812.339:31): arch=c000003e syscall=1 success=yes exit=4 a0=3 a1=7ffe763a76d0 a2=4 a3=0 items=0 ppid=2541 pid=2916 auid=1001 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=7 comm="sshd" exe="/usr/bin/sshd" key=(null)ARCH=x86_64 SYSCALL=write AUID="lyuba" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"
type=PROCTITLE msg=audit(1649687812.339:31): proctitle=737368643A206C79756261205B707269765D
type=USER_START msg=audit(1649687812.339:32): pid=2916 uid=0 auid=1001 ses=7 msg='op=PAM:session_open grantors=pam_loginuid,pam_keyinit,pam_limits,pam_unix,pam_permit,pam_mail,pam_elogind,pam_env acct="lyuba" exe="/usr/bin/sshd" hostname=172.30.40.21 addr=172.30.40.21 terminal=ssh res=success'UID="root" AUID="lyuba"
type=CRED_ACQ msg=audit(1649687812.339:33): pid=2919 uid=0 auid=1001 ses=7 msg='op=PAM:setcred grantors=pam_shells,pam_faillock,pam_permit,pam_faillock acct="lyuba" exe="/usr/bin/sshd" hostname=172.30.40.21 addr=172.30.40.21 terminal=ssh res=success'UID="root" AUID="lyuba"
type=SYSCALL msg=audit(1649687812.349:34): arch=c000003e syscall=59 success=yes exit=0 a0=562e06b31eb0 a1=7ffe763a66a0 a2=562e06b377f0 a3=0 items=2 ppid=2919 pid=2920 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=pts2 ses=7 comm="zsh" exe="/usr/bin/zsh" key=(null)ARCH=x86_64 SYSCALL=execve AUID="lyuba" UID="lyuba" GID="lyuba" EUID="lyuba" SUID="lyuba" FSUID="lyuba" EGID="lyuba" SGID="lyuba" FSGID="lyuba"
type=EXECVE msg=audit(1649687812.349:34): argc=1 a0="-zsh"
type=CWD msg=audit(1649687812.349:34): cwd="/home/lyuba"
type=PATH msg=audit(1649687812.349:34): item=0 name="/bin/zsh" inode=4987969 dev=103:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PATH msg=audit(1649687812.349:34): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=4984184 dev=103:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PROCTITLE msg=audit(1649687812.349:34): proctitle="-zsh"
type=SYSCALL msg=audit(1649687812.353:35): arch=c000003e syscall=59 success=yes exit=0 a0=7f68ef823cf8 a1=7f68ef823d48 a2=56361c2ae090 a3=8 items=2 ppid=2920 pid=2921 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=pts2 ses=7 comm="tty" exe="/usr/bin/tty" key=(null)ARCH=x86_64 SYSCALL=execve AUID="lyuba" UID="lyuba" GID="lyuba" EUID="lyuba" SUID="lyuba" FSUID="lyuba" EGID="lyuba" SGID="lyuba" FSGID="lyuba"
type=EXECVE msg=audit(1649687812.353:35): argc=1 a0="/usr/bin/tty"
type=CWD msg=audit(1649687812.353:35): cwd="/home/lyuba"
type=PATH msg=audit(1649687812.353:35): item=0 name="/usr/bin/tty" inode=4993703 dev=103:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PATH msg=audit(1649687812.353:35): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=4984184 dev=103:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PROCTITLE msg=audit(1649687812.353:35): proctitle="/usr/bin/tty"
type=USER_END msg=audit(1649687819.389:36): pid=2916 uid=0 auid=1001 ses=7 msg='op=PAM:session_close grantors=pam_loginuid,pam_keyinit,pam_limits,pam_unix,pam_permit,pam_mail,pam_elogind,pam_env acct="lyuba" exe="/usr/bin/sshd" hostname=172.30.40.21 addr=172.30.40.21 terminal=ssh res=success'UID="root" AUID="lyuba"
type=CRED_DISP msg=audit(1649687819.389:37): pid=2916 uid=0 auid=1001 ses=7 msg='op=PAM:setcred grantors=pam_shells,pam_faillock,pam_permit,pam_faillock acct="lyuba" exe="/usr/bin/sshd" hostname=172.30.40.21 addr=172.30.40.21 terminal=ssh res=success'UID="root" AUID="lyuba"
type=SYSCALL msg=audit(1649687819.396:38): arch=c000003e syscall=59 success=yes exit=0 a0=562b465bb5b0 a1=562b465bc9b0 a2=562b465bc610 a3=8 items=2 ppid=2923 pid=2924 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="rmdir" exe="/usr/bin/rmdir" key=(null)ARCH=x86_64 SYSCALL=execve AUID="unset" UID="root" GID="root" EUID="root" SUID="root" FSUID="root" EGID="root" SGID="root" FSGID="root"
type=EXECVE msg=audit(1649687819.396:38): argc=2 a0="rmdir" a1="/sys/fs/cgroup/openrc//7"
type=CWD msg=audit(1649687819.396:38): cwd="/"
type=PATH msg=audit(1649687819.396:38): item=0 name="/bin/rmdir" inode=4993675 dev=103:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PATH msg=audit(1649687819.396:38): item=1 name="/lib64/ld-linux-x86-64.so.2" inode=4984184 dev=103:02 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0OUID="root" OGID="root"
type=PROCTITLE msg=audit(1649687819.396:38): proctitle=726D646972002F7379732F66732F6367726F75702F6F70656E72632F2F37