# I3lock not configured correctly maybe due to bad PAM configurtion in default NixOS?
**URL:** https://discourse.nixos.org/t/i3lock-not-configured-correctly-maybe-due-to-bad-pam-configurtion-in-default-nixos/63538
**Category:** Help
**Created:** [April 27, 2025, 4:18pm UTC](https://discourse.nixos.org/t/i3lock-not-configured-correctly-maybe-due-to-bad-pam-configurtion-in-default-nixos/63538 "2025-04-27T16:18:48Z")
**Posts on this page:** 18
**Page:** 1
### Author:  [@zamlz](https://discourse.nixos.org/u/zamlz)
#### Post date: [April 27, 2025, 4:18pm UTC](https://discourse.nixos.org/t/i3lock-not-configured-correctly-maybe-due-to-bad-pam-configurtion-in-default-nixos/63538/1 "2025-04-27T16:18:48Z")
`i3lock` does not appear to be functioning correctly anymore. Anytime I input the correct password, it refused to unlock. I have been able to unlock by going to `tty2` and running `pkill i3lock` after logging into that terminal session.
I also verified the password I was giving `i3lock` by running `i3lock --debug` in my terminal. It prints my key presses and I was able to see that I was in fact inputting my password correctly.
I did [some research](https://github.com/i3/i3lock/issues/119) and it seems like this could be a setup issue on Nixos’s side of things? Specifically related to PAM. I have not touched PAM at all in my configuration but perhaps someone else is more familiar with what’s going on?
---
### Author:  [@GirardR1006](https://discourse.nixos.org/u/GirardR1006)
#### Post date: [April 27, 2025, 5:49pm UTC](https://discourse.nixos.org/t/i3lock-not-configured-correctly-maybe-due-to-bad-pam-configurtion-in-default-nixos/63538/2 "2025-04-27T17:49:01Z")
It seems to be related to a recent change on [PAM handling](https://discourse.nixos.org/t/breaking-changes-announcement-for-unstable/17574/78). Which version of Nixpkgs are you following?
---
### Author:  [@zamlz](https://discourse.nixos.org/u/zamlz)
#### Post date: [May 5, 2025, 1:44am UTC](https://discourse.nixos.org/t/i3lock-not-configured-correctly-maybe-due-to-bad-pam-configurtion-in-default-nixos/63538/3 "2025-05-05T01:44:08Z")
I am following the unstable branch.
```auto
"nixpkgs": {
"locked": {
"lastModified": 1746141548,
"narHash": "sha256-IgBWhX7A2oJmZFIrpRuMnw5RAufVnfvOgHWgIdds+hc=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "f02fddb8acef29a8b32f10a335d44828d7825b78",
"type": "github"
},
"original": {
"owner": "nixos",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
```
---
### Author:  [@rhendric](https://discourse.nixos.org/u/rhendric)
#### Post date: [May 5, 2025, 2:33am UTC](https://discourse.nixos.org/t/i3lock-not-configured-correctly-maybe-due-to-bad-pam-configurtion-in-default-nixos/63538/4 "2025-05-05T02:33:58Z")
Have you set [`programs.i3lock.enable`](https://search.nixos.org/options?channel=unstable&show=programs.i3lock.enable) to true?
---
### Author:  [@zamlz](https://discourse.nixos.org/u/zamlz)
#### Post date: [May 5, 2025, 3:04am UTC](https://discourse.nixos.org/t/i3lock-not-configured-correctly-maybe-due-to-bad-pam-configurtion-in-default-nixos/63538/5 "2025-05-05T03:04:49Z")
Oh you know what, I do not. I did not do this because my i3lock installed manually through my home manager config.
I guess I’ll need to do something hacky here, but I can figure it out. I was trying to setup everything as much as possible through home manager, but it looks like that’s not really going to be possible here.
---
### Author:  [@zamlz](https://discourse.nixos.org/u/zamlz)
#### Post date: [May 6, 2025, 6:58pm UTC](https://discourse.nixos.org/t/i3lock-not-configured-correctly-maybe-due-to-bad-pam-configurtion-in-default-nixos/63538/6 "2025-05-06T18:58:08Z")
Okay unfortunately, I’m not completely sure that’s it. I am using the i3lock provided through `programs.i3lock.enable`.
---
### Author:  [@rhendric](https://discourse.nixos.org/u/rhendric)
#### Post date: [May 6, 2025, 7:36pm UTC](https://discourse.nixos.org/t/i3lock-not-configured-correctly-maybe-due-to-bad-pam-configurtion-in-default-nixos/63538/7 "2025-05-06T19:36:18Z")
Hmm. A few things to test:
- Is there a symlink at `/etc/pam.d/i3lock`?
- In a REPL loaded with your NixOS config (on a channels-based system, I’d do this with `nix repl --file ''`; I don’t know if that works for flakes too), can you confirm that
- `config.programs.i3lock.enable` is definitely true?
- `config.security.pam.services.i3lock.enable` is also true?
---
### Author:  [@zamlz](https://discourse.nixos.org/u/zamlz)
#### Post date: [May 6, 2025, 9:09pm UTC](https://discourse.nixos.org/t/i3lock-not-configured-correctly-maybe-due-to-bad-pam-configurtion-in-default-nixos/63538/8 "2025-05-06T21:09:45Z")
> [@rhendric](#):
>
> Is there a symlink at `/etc/pam.d/i3lock`?
OH well I can confirm no such symlink exists on my system
So with flakes, I did the following
> $ nix repl
>
> nix-repl\> x = builtins.getFlake “/path/to/project/dir”
> nix-repl\> x.nixosConfigurations.solaris.options.programs.i3lock.enable
> {
> \_\_toString = «lambda \_\_toString @ /nix/store/zggank8h7rfa8p2rrnwymjcpj3k4ds5l-source/lib/modules.nix:1091:20»;
> \_type = “option”;
> declarationPositions = […];
> declarations = […];
> default = false;
> definitions = […];
> definitionsWithLocations = […];
> description = “Whether to enable i3lock.”;
> example = true;
> files = […];
> highestPrio = 100;
> isDefined = true;
> loc = […];
> options = […];
> type = { … };
> value = true;
> }
But then take a look at this.
> nix-repl\> x.nixosConfigurations.solaris.options.security.pam.services.i3lock.enable
> error: attribute ‘i3lock’ missing
> at «string»:1:1:
> 1| x.nixosConfigurations.solaris.options.security.pam.services.i3lock.enable
> | ^
I was able to autocomplete this until I got to the “security” attribute.
---
### Author:  [@rhendric](https://discourse.nixos.org/u/rhendric)
#### Post date: [May 7, 2025, 7:14pm UTC](https://discourse.nixos.org/t/i3lock-not-configured-correctly-maybe-due-to-bad-pam-configurtion-in-default-nixos/63538/9 "2025-05-07T19:14:23Z")
You’re showing me the `options.` tree; check `config.` instead please?
---
### Author:  [@zamlz](https://discourse.nixos.org/u/zamlz)
#### Post date: [May 15, 2025, 3:49am UTC](https://discourse.nixos.org/t/i3lock-not-configured-correctly-maybe-due-to-bad-pam-configurtion-in-default-nixos/63538/10 "2025-05-15T03:49:14Z")
> [@zamlz](#):
>
> x.nixosConfigurations.solaris.options.programs.i3lock.enable
```auto
nix-repl> x.nixosConfigurations.solaris.config.programs.i3lock.enable
true
nix-repl> x.nixosConfigurations.solaris.config.security.pam.services.i3lock.enable
true
```
Sorry for the late reply, here we go!
---
### Author:  [@rhendric](https://discourse.nixos.org/u/rhendric)
#### Post date: [May 15, 2025, 6:54am UTC](https://discourse.nixos.org/t/i3lock-not-configured-correctly-maybe-due-to-bad-pam-configurtion-in-default-nixos/63538/11 "2025-05-15T06:54:42Z")
I’m at a loss. With those values set to `true`, I don’t see how it could be possible that a system gets built without an `/etc/pam.d/i3lock` symlink. I guess double-check that you’re building what you think you’re building?
---
### Author:  [@zamlz](https://discourse.nixos.org/u/zamlz)
#### Post date: [May 15, 2025, 3:57pm UTC](https://discourse.nixos.org/t/i3lock-not-configured-correctly-maybe-due-to-bad-pam-configurtion-in-default-nixos/63538/12 "2025-05-15T15:57:58Z")
Hmmm weird, I just checked and have the symlink now and everything works. I did update my flakes sometime during this. But I think it’s very likely possible I mixed up configurations and didn’t have it enabled correctly either. I’m very sorry for the troubles. It looks like things are working find again.
---
### Author:  [@dmo84](https://discourse.nixos.org/u/dmo84)
#### Post date: [June 17, 2025, 9:25am UTC](https://discourse.nixos.org/t/i3lock-not-configured-correctly-maybe-due-to-bad-pam-configurtion-in-default-nixos/63538/13 "2025-06-17T09:25:49Z")
After migrating von NixOS 24.11 (based on nix-channels) to NixOS 25.05 (switched to nix-flakes) I experienced the same issues.
The last time I touched my i3 and pam.d related config was 2 years ago.
So I assume that the way NixOS implements the pam.d related configuration was modified.
Edit: @GirardR1006 was right → [I3lock not configured correctly maybe due to bad PAM configurtion in default NixOS? - #2 by GirardR1006](https://discourse.nixos.org/t/i3lock-not-configured-correctly-maybe-due-to-bad-pam-configurtion-in-default-nixos/63538/2)
Your hints were very helpful to me to fix the issue on my machines - thank you for documenting your approach.
---
### Author:  [@guija](https://discourse.nixos.org/u/guija)
#### Post date: [June 25, 2025, 10:16am UTC](https://discourse.nixos.org/t/i3lock-not-configured-correctly-maybe-due-to-bad-pam-configurtion-in-default-nixos/63538/14 "2025-06-25T10:16:42Z")
Same issue happend to me when I upgraded from the stable 25.05 channel to the unstable channel.
Before my config to install i3 was:
```auto
services.xserver = {
# enable = true;
desktopManager = {
xterm.enable = false;
};
windowManager.i3 = {
enable = true;
extraPackages = with pkgs; [
dmenu #application launcher most people use
i3status # gives you the default i3 status bar
i3lock #default i3 screen locker
i3blocks #if you are planning on using i3blocks over i3status
];
};
};
```
And I changed it to:
```auto
services.xserver = {
# enable = true;
desktopManager = {
xterm.enable = false;
};
windowManager.i3 = {
enable = true;
extraPackages = with pkgs; [
dmenu #application launcher most people use
i3status # gives you the default i3 status bar
i3blocks #if you are planning on using i3blocks over i3status
];
};
};
programs.i3lock.enable = true;
```
Note that I added `programs.i3lock.enable = true;` and removed `i3lock` from the extra packages.
---
### Author:  [@rnhmjoj](https://discourse.nixos.org/u/rnhmjoj)
#### Post date: [June 25, 2025, 11:29am UTC](https://discourse.nixos.org/t/i3lock-not-configured-correctly-maybe-due-to-bad-pam-configurtion-in-default-nixos/63538/15 "2025-06-25T11:29:43Z")
This has just been fixed: [nixos/i3: fix i3lock default enable-ing by Ten0 · Pull Request #417193 · NixOS/nixpkgs · GitHub](https://github.com/NixOS/nixpkgs/pull/417193)
---
### Author:  [@zamlz](https://discourse.nixos.org/u/zamlz)
#### Post date: [June 25, 2025, 11:13pm UTC](https://discourse.nixos.org/t/i3lock-not-configured-correctly-maybe-due-to-bad-pam-configurtion-in-default-nixos/63538/16 "2025-06-25T23:13:02Z")
Wait, are you saying I no longer need to use the `program` option anymore?
---
### Author:  [@tejing](https://discourse.nixos.org/u/tejing)
#### Post date: [June 25, 2025, 11:15pm UTC](https://discourse.nixos.org/t/i3lock-not-configured-correctly-maybe-due-to-bad-pam-configurtion-in-default-nixos/63538/17 "2025-06-25T23:15:25Z")
If you set `services.xserver.windowManager.i3.enable = true;`, yes. (Assuming the PR has hit the channel already. Haven’t checked.)
---
### Author:  [@zamlz](https://discourse.nixos.org/u/zamlz)
#### Post date: [June 26, 2025, 3:09am UTC](https://discourse.nixos.org/t/i3lock-not-configured-correctly-maybe-due-to-bad-pam-configurtion-in-default-nixos/63538/18 "2025-06-26T03:09:05Z")
Ahh I guess it won’t apply to me. I do not use the full i3 suite.