### System details

Apple MacBook Pro 14" M2 Pro (2023, Mac14,9, aarch64/Asahi), Omarchy 4.0.3rc4-1, pam 1.7.2-2

### What's wrong?

After 10 wrong sudo passwords, `pam_faillock` locks the account as configured (`deny=10 unlock_time=120` from `install/config/increase-lockout-limit.sh`). However, the `preauth` line uses `silent`, so nothing tells the user the account is locked. sudo keeps saying `Sorry, try again.`, and the lock screen says the password is incorrect, **even when the correct password is typed**. From the user's side, the password has simply stopped working, and rebooting (which clears `/run/faillock`) is the only fix they find. This has happened to me twice.

This is the same symptom as #1996 and #2094. Both were closed after the limit was raised to 10 tries. The limit is fine; what's missing is any sign that a lockout is happening.

**Evidence (journal, previous boot):**

- 15:01:40 to 15:03:23: 10 failed sudo attempts (`pam_unix(sudo:auth): authentication failure`, plus `conversation failed`) while running `pacman -S ghostty`. The account is now locked.
- 15:03:40 to 15:06:48: more sudo attempts, all rejected.
- 15:09:09: one wrong password at the lock screen (`omarchy-lock-password`).
- 15:09:15: the correct password. `unix_chkpwd` accepts it, but the lock screen still rejects it:

```
15:09:15.313 audit: op=PAM:unix_chkpwd acct="jordi" exe="/usr/bin/unix_chkpwd" res=success
15:09:17.307 omarchy-shell: quickshell.service.pam.subprocess: ... Failed to authenticate.
```

**Why the lockout seems permanent:** `unlock_time=120` looks short, but the default `fail_interval` is 900 s, and the old failures stay counted for that whole window. After the 2 minutes pass, a single typo brings the count back to 10 and locks the account for another 2 minutes. A user who keeps retrying, which is the natural thing to do when told the password is "incorrect", stays locked out. There is also no way to unlock from inside the session: `omarchy sudo reset` was removed in #8046, and `su` goes through the same locked stack.

**Steps to reproduce:**

1. Type a wrong password at a `sudo` prompt 10 times.
2. Type the correct password at `sudo`, or at the lock screen, within 2 minutes. It is rejected as incorrect.
3. Keep making the occasional typo. The lockout keeps renewing itself.

**Expected:** a clear "account locked, try again in N seconds" message instead of "incorrect password".

**Possible fixes:**

- Remove `silent` from the `pam_faillock.so preauth` line in `/etc/pam.d/system-auth` and `/etc/pam.d/omarchy-lock-password`. sudo would then print pam_faillock's own message: `The account is locked due to 10 failed logins. (N minutes left to unlock)`.
- Have the lock screen check `faillock --user $USER` after a failed attempt and show the lock state and the time left.
- Optionally, set `fail_interval` close to `unlock_time` so one typo after the lock ends doesn't lock the account again.

Possibly related: #12285 (sudo in foot on Asahi logs `conversation failed` for correctly typed passwords), which could explain why wrong attempts added up so quickly here.

<details>
<summary>Debug info</summary>

This Omarchy build (Asahi) doesn't ship `omarchy debug`, so these are the relevant parts collected by hand.

Package: `omarchy 4.0.3rc4-1`

```
System:
  Kernel: 7.1.13-3-2-ARCH arch: aarch64 bits: 64
  Desktop: Hyprland v: 0.56.2 Distro: Arch Linux ARM
Graphics:
  Device-1: agx-t6020 driver: asahi v: N/A
  Device-2: display-subsystem driver: apple_drm v: N/A
  Display: wayland server: X.org v: 1.21.1.24 with: Xwayland v: 24.1.13 compositor: Hyprland
    v: 0.56.2 driver: gpu: apple-dcp,apple-drm,dcp-dp-audio resolution: no compositor data
    resolution: 1: 3840x2160
```

`pam_faillock` lines in `/etc/pam.d/system-auth` and `/etc/pam.d/omarchy-lock-password`:

```
auth       required                    pam_faillock.so preauth silent deny=10 unlock_time=120
auth       [default=die]               pam_faillock.so authfail deny=10 unlock_time=120
auth       required                    pam_faillock.so      authsucc
auth       required                    pam_faillock.so preauth silent deny=10 unlock_time=120
auth       [default=die]               pam_faillock.so authfail deny=10 unlock_time=120
auth       required                    pam_faillock.so authsucc
```

Auth journal from the affected boot (`journalctl -b -1`, 15:01 to 15:10):

```
15:01:40.004871 unix_chkpwd[392599]: password check failed for user (jordi)
15:01:40.005095 sudo[392353]: pam_unix(sudo:auth): authentication failure; logname=jordi uid=1001 euid=0 tty=/dev/pts/3 ruser=jordi rhost=  user=jordi
15:01:46.431842 unix_chkpwd[392934]: password check failed for user (jordi)
15:01:53.099759 unix_chkpwd[393316]: password check failed for user (jordi)
15:02:17.244517 sudo[392353]: pam_unix(sudo:auth): conversation failed
15:02:17.244527 sudo[392353]: pam_unix(sudo:auth): auth could not identify password for [jordi]
15:02:18.683840 sudo[392353]:    jordi : 5 incorrect password attempts ; TTY=pts/3 ; PWD=<redacted> ; USER=root ; COMMAND=/usr/bin/pacman -S --noconfirm --needed ghostty
15:03:15.224995 unix_chkpwd[399677]: password check failed for user (jordi)
15:03:15.225214 sudo[399074]: pam_unix(sudo:auth): authentication failure; logname=jordi uid=1001 euid=0 tty=/dev/pts/4 ruser=jordi rhost=  user=jordi
15:03:23.190565 sudo[399074]: pam_unix(sudo:auth): conversation failed
15:03:23.190579 sudo[399074]: pam_unix(sudo:auth): auth could not identify password for [jordi]
15:03:24.717278 sudo[399074]:    jordi : 2 incorrect password attempts ; TTY=pts/4 ; PWD=<redacted> ; USER=root ; COMMAND=/usr/bin/su
15:05:58.361361 sudo[401038]: pam_unix(sudo:auth): conversation failed
15:05:58.361376 sudo[401038]: pam_unix(sudo:auth): auth could not identify password for [jordi]
15:06:01.034680 sudo[401038]:    jordi : 1 incorrect password attempt ; TTY=pts/4 ; PWD=<redacted> ; USER=root ; COMMAND=/usr/bin/su
15:06:39.005139 sudo[396660]: pam_unix(sudo:auth): conversation failed
15:06:39.005151 sudo[396660]: pam_unix(sudo:auth): auth could not identify password for [jordi]
15:06:41.362185 sudo[396660]:    jordi : 1 incorrect password attempt ; TTY=pts/3 ; PWD=<redacted> ; USER=root ; COMMAND=/usr/bin/pacman -S --noconfirm --needed ghostty
15:09:09.795018 omarchy-shell[424372]: quickshell.service.pam.subprocess: Starting pam session for user "jordi" with config "omarchy-lock-password" in dir "/etc/pam.d"
15:09:09.911000 audit[424409]: AUDIT1100 pid=424409 uid=1001 msg='op=PAM:unix_chkpwd acct="jordi" exe="/usr/bin/unix_chkpwd" hostname=? addr=? terminal=? res=failed'
15:09:09.912977 unix_chkpwd[424409]: password check failed for user (jordi)
15:09:09.913195 quickshell[424372]: pam_unix(omarchy-lock-password:auth): authentication failure; logname=jordi uid=1001 euid=1001 tty= ruser= rhost=  user=jordi
15:09:11.766055 omarchy-shell[424372]: quickshell.service.pam.subprocess: Got response for request.quickshell.service.pam.subprocess: Failed to authenticate.
15:09:15.257021 omarchy-shell[425843]: quickshell.service.pam.subprocess: Starting pam session for user "jordi" with config "omarchy-lock-password" in dir "/etc/pam.d"
15:09:15.313000 audit[425868]: AUDIT1100 pid=425868 uid=1001 msg='op=PAM:unix_chkpwd acct="jordi" exe="/usr/bin/unix_chkpwd" hostname=? addr=? terminal=? res=success'
15:09:17.307066 omarchy-shell[425843]: quickshell.service.pam.subprocess: Got response for request.quickshell.service.pam.subprocess: Failed to authenticate.
15:09:21.932480 omarchy-shell[427292]: quickshell.service.pam.subprocess: Starting pam session for user "jordi" with config "omarchy-lock-password" in dir "/etc/pam.d"
15:09:21.987000 audit[427337]: AUDIT1100 pid=427337 uid=1001 msg='op=PAM:unix_chkpwd acct="jordi" exe="/usr/bin/unix_chkpwd" hostname=? addr=? terminal=? res=success'
15:09:24.067039 omarchy-shell[427292]: quickshell.service.pam.subprocess: Got response for request.quickshell.service.pam.subprocess: Failed to authenticate.
15:09:26.463997 omarchy-shell[428230]: quickshell.service.pam.subprocess: Starting pam session for user "jordi" with config "omarchy-lock-password" in dir "/etc/pam.d"
15:09:26.535000 audit[428267]: AUDIT1100 pid=428267 uid=1001 msg='op=PAM:unix_chkpwd acct="jordi" exe="/usr/bin/unix_chkpwd" hostname=? addr=? terminal=? res=success'
15:09:29.011640 omarchy-shell[428230]: quickshell.service.pam.subprocess: Got response for request.quickshell.service.pam.subprocess: Failed to authenticate.
```

</details>