That would answer my issue yesterday, but raises another question. What dictates if something is worthy of being put on the bulletin board on the main website? I added 2FA way back when to /etc/pam.d/system-login and that meant that pacman placed a .pacnew file alongside the modified system-login (as expected) on upgrade. But the notification about this got lost in the sea of packages which is on me of course. But seeing as this is a modification to a system critical file can (and did) cause a complete lockout of accounts on the machine due to `auth required` being the keywords put in place. I would have expected this to be on the bulletin board about possible manual intervention required. Perhaps I just missed it under another title? Best wishes: Anton Hvornum On Mon, Feb 22, 2021 at 12:57 PM Björn Fries via arch-general wrote:

...

I can't remember if I've added the following to /etc/pam.d/system-login or not:

auth required pam_tally2.so onerr=succeed file=/var/log/tallylog

The line was changed by https://github.com/archlinux/svntogit-packages/commit/7afa3fb3a9e74c27f4c2af...

to

auth required pam_faillock.so onerr=succeed file=/var/log/tallylog

and pam_faillock was moved to /etc/pam.d/system-auth by https://github.com/archlinux/svntogit-packages/commit/2d5af94ae55a5c98837ce9...

On 2021-02-22 13:58:36, Anton Hvornum via arch-general wrote:

That would answer my issue yesterday, but raises another question.

What dictates if something is worthy of being put on the bulletin board on the main website?

I added 2FA way back when to /etc/pam.d/system-login and that meant that pacman placed a .pacnew file alongside the modified system-login (as expected) on upgrade. But the notification about this got lost in the sea of packages which is on me of course. But seeing as this is a modification to a system critical file can (and did) cause a complete lockout of accounts on the machine due to `auth required` being the keywords put in place. I would have expected this to be on the bulletin board about possible manual intervention required.

These days I don't pacman -Syu, I have a script that: - checks the news - runs -Syu - runs pacdiff It's saved me a lot of hassle, but doesn't catch everything. For me, I would use an option that allowed pacman to 'pause' on messages (like post install stuff) to give me time to read them.

On 2/22/21 6:58 AM, Anton Hvornum via arch-general wrote:

I added 2FA way back when to /etc/pam.d/system-login and that meant that pacman placed a .pacnew file alongside the modified system-login (as expected) on upgrade. But the notification about this got lost in the sea of packages which is on me of course. But seeing as this is a modification to a system critical file can (and did) cause a complete lockout of accounts on the machine due to `auth required` being the keywords put in place. I would have expected this to be on the bulletin board about possible manual intervention required.

Arch does a fantastic job in doing all that it does in a rolling release, so don't take this the wrong way, but I do agree with Anton a bit here. Over the years (12 now), there have been 4-5 times that an update with pacman -Syu has left me with either a critical server package in need of an immediate day long learn and reconfigure session, or a change has left remote adminned machines unreachable. (considering the 100's of thousands of package upgrades over those 12 years, those are quite good stats) But if there is any way to do a double-check on system critical or server critical packages and drop a note if some type of breakage or immediate attention will be needed would be welcomed. I know, I know, in a perfect-world we would have all the manpower desired to look at ever aspect up potential adverse impacts and would all be informed of each upcoming change, but we live in the real-world and there will be some changes that hit some harder than others. I can't see the user solution being building different systems to pre-check if pacman -Syu is advisable. The Arch way has always been that only current systems fully updated by pacman -Syu are supported and throughout the wiki, etc.. the advice being "make sure you do a pacman -Syu before ..." We should ensure, to the greatest extent possible, that (1.) pacman -Syu remains the safe, gold-standard on how updates are done, and (2.) make a good effort to note any changes likely to cause problems on archlinux.org. It's hard to make what is already done well, better, but there is always room for improvement. -- David C. Rankin, J.D.,P.E.