Hi,

Since 1.33.1-2, debian/lightdm.sysusers has:

  u! lightdm - "Light Display Manager" /var/lib/lightdm /bin/false

With "u!", systemd-sysusers (systemd 262-1) locks the account. It sets
the expiry date to 1. On a new install /etc/shadow has:

  lightdm:!*:20727:::::1:

  # chage -l lightdm
  Account expires : Jan 02, 1970

When the greeter starts, logind starts user@.service for lightdm. The
PAM account check fails, so the unit fails:

  (systemd)[1093]: pam_unix(systemd-user:account): account lightdm has
expired (account expired)
  (systemd)[1093]: user@980.service: Failed to set up PAM session:
Operation not permitted
  systemd[1]: user@980.service: Failed with result 'exit-code'.

The greeter still shows, but "systemctl is-system-running" reports
"degraded".

Only new installs are affected. systemd-sysusers does not change an
account that already exists.

Other display managers use plain "u" (sddm, gdm3, greetd,
plasma-login-manager). Plain "u" still sets an invalid password, so
nobody can log in with a password.

Fix:
--- a/debian/lightdm.sysusers
+++ b/debian/lightdm.sysusers
@@ -1 +1 @@
-u! lightdm - "Light Display Manager" /var/lib/lightdm /bin/false
+u lightdm - "Light Display Manager" /var/lib/lightdm /bin/false

Workaround: chage -E -1 lightdm

I tested the workaround: after it, user@980.service is active and the
system state is "running".

Thanks, Kel

Hi Kel, thanks for the bug and the patch. I'm adding Luca to the recipients
since he authored the patch, to check with him if it looks ok.

Regards,

Hi Kel, thanks for the bug and the patch. I'm adding Luca to the recipients
since he authored the patch, to check with him if it looks ok.

Regards,

Hello maintainers of lightdm, Luca,

After some debugging, I've found out why the Lomiri desktop is unable to boot on a fresh install: the lightdm user is locked.

I've seen the issue happening in openQA on fresh installations, but did not spend time on finding the cause until now.

If a Debian system is installed with 1.33.1-1, the user lightdm is created without a lock, using the postinst script.
If a Debian system is installed with 1.33.1-3, the user lightdm is created with a lock, using the systemd-sysuser strategy.

Upon upgrades the lightdm user stays unmodified, the issue is therefore seen only on fresh installations.

The proposed change from 'u!' to 'u' restores the original behaviour (and allows the user to log in with the Lomiri desktop)

With kind regards,
Roland Clobus

Details:
* I've installed a system with a netinst image from 2026-09-01
* I've used snapshot.debian.org to have a fresh installation with 2026-09-19T00:00:00Z and 2026-09-20T00:00:00Z

We believe that the bug you reported is fixed in the latest version of
lightdm, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1149648@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Yves-Alexis Perez <corsac@debian.org> (supplier of updated lightdm package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 04 Oct 2026 14:45:18 +0200
Source: lightdm
Architecture: source
Version: 1.33.1-4
Distribution: unstable
Urgency: medium
Maintainer: Debian Xfce Maintainers <debian-xfce@lists.debian.org>
Changed-By: Yves-Alexis Perez <corsac@debian.org>
Closes: 1149648
Changes:
 lightdm (1.33.1-4) unstable; urgency=medium
 .
   * d/lightdm.sysusers: don't set user as disabled (Closes: #1149648)
Checksums-Sha1:
 22ac3d41e46921704da6966b916d9f2bdca122ce 2397 lightdm_1.33.1-4.dsc
 d8f5ad509c1d3d5668d580a64e2171a0e89b114f 41360 lightdm_1.33.1-4.debian.tar.xz
 79915fada5fb213ad1eb66a5487e27a8d19328c1 22275 lightdm_1.33.1-4_amd64.buildinfo
Checksums-Sha256:
 ea408de6d7d7030f1e1e1486972d76fdd8acc6b0e86bc6db1117bfa1817c077d 2397 lightdm_1.33.1-4.dsc
 ee57374585bff139f6d10aa6bc854ace708b5269fdbe7ba562bbaa2443eb7b7a 41360 lightdm_1.33.1-4.debian.tar.xz
 f5e50a95832526f06b6c5c07fd1c1d9bbe59a4c3ddd1e087977bce4ded2e8993 22275 lightdm_1.33.1-4_amd64.buildinfo
Files:
 e63c5addaf042da54c925fb5a795a928 2397 x11 optional lightdm_1.33.1-4.dsc
 00e4ef6b2644142952d908fd35fa6400 41360 x11 optional lightdm_1.33.1-4.debian.tar.xz
 9d0a41c6acfb4edf49515fd652ad29fe 22275 x11 optional lightdm_1.33.1-4_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEE8vi34Qgfo83x35gF3rYcyPpXRFsFAmrCSuoACgkQ3rYcyPpX
RFtVWgf+LzapZLlCOOTziuy7bpZXGqJaYfEuARialuJ0Y+fbi/Ovsqh5wUkxdcwK
+dB529ksJ5UtJoskf+bAWaHLqPmPkAEkTQ2bnZfcW53aG8YPricQZYsFFN2euLgb
WYtI6XPyQdZqGp/IMD3NX+H8QJJKRTuvvac0N1PUn7quDp+xZjeaUwccT4NgG6PW
L5FCE0KCCduE4+93tJtbj91vEpYMycbkE7B+lr8DJVMDOc9aZmxcD42laMOj+k4y
DVFOw23OSopPeQz8IS3ExLS+yYPjJC0yxKcHQame4qHdEEhRFn3pnXB7J6UHMflo
+FZi4MXF8vDUYZPx/AOxT9wvnAz9cg==
=cXED
-----END PGP SIGNATURE-----