Why is it trying to access gnome-keyring? I don't find unix_checkpwd in any /etc/pam.d/ file. Oct 07 16:55:00 magrathea.cryptomilk.site su[9434]: The gnome keyring socket is not owned with the same credentials as the user login: /run/user/1000/keyring/control Oct 07 16:55:00 magrathea.cryptomilk.site su[9434]: gkr-pam: couldn't unlock the login keyring. Oct 07 16:55:00 magrathea.cryptomilk.site unix_chkpwd[9435]: check pass; user unknown Oct 07 16:55:00 magrathea.cryptomilk.site unix_chkpwd[9436]: check pass; user unknown Oct 07 16:55:00 magrathea.cryptomilk.site unix_chkpwd[9436]: password check failed for user (root) Oct 07 16:55:00 magrathea.cryptomilk.site su[9434]: pam_unix(su:auth): authentication failure; logname= uid=1000 euid=1000 tty=pts/17 ruser=asn rhost= user=root