Configuring i3-wm to allow user switching during a lock screen is not possible because the lock mechanism, such as i3lock or slock, operates at the display server level and blocks all input. Linux security models isolate sessions via PAM and display managers, meaning a locked session cannot be bypassed by another user without first unlocking it with valid credentials for that specific session.
The Security Model of X11 Locking
In Linux environments using the X Window System, tools like i3lock or slock function by taking exclusive control of the keyboard and mouse input. They render a full-screen overlay that prevents any other application from receiving events. This design is intentional and fundamental to session security. It ensures that no unauthorized user can interact with the desktop environment while it is locked.
The misconception that one can configure the lock screen to switch users stems from confusing session locking with display manager login screens. Display managers like GDM, SDDM, or LightDM provide a graphical interface for selecting users and entering passwords before an X session even begins. Once an i3 session is active and locked, the display manager is no longer involved in the authentication process for that specific seat. Therefore, there is no configuration option within i3wm itself to enable multi-user switching from the lock state.
Why PAM Edits Are Dangerous and Incorrect
Some online guides suggest editing PAM (Pluggable Authentication Modules) configurations to allow rootless user switching or bypassing password checks. These suggestions are technically false and dangerous. Modifying PAM stacks to weaken authentication can expose the system to privilege escalation attacks and data breaches.
PAM handles authentication for login services, but it does not grant permission for concurrent interactive session switching on a locked X server. Attempting to hack around this limitation violates the principle of least privilege. The correct approach is to understand that each user session is independent. If User A locks their machine, User B cannot access it unless they have physical access to unlock it with User A’s password, which defeats the purpose of locking.
Proper Alternatives for Multi-User Workflows
If your goal is to allow multiple users to share a single physical machine without logging out completely, you must use technologies designed for session management rather than trying to break the lock screen. Here are the standard, secure methods:
- Virtual Consoles (TTY): You can switch to a virtual console using
Ctrl+Alt+F2throughF6. However, this drops you out of the graphical environment entirely into a text-based login prompt. While this allows another user to log in, it terminates the current X session or leaves it suspended depending on the init system. This is not "user switching" within the GUI but rather session suspension. - Display Manager Login Screen: The most robust solution is to stop using
i3lockfor long-term unattended periods. Instead, log out of your i3 session and return to the display manager (like GDM or SDDM). From there, another user can select their profile and log in. This preserves the hardware state but requires a full logout. - Xephyr or Nested X Servers: Advanced users sometimes run nested X servers to simulate separate sessions, but this is complex to configure and does not integrate seamlessly with the host’s window manager for true user switching.
For systems requiring frequent user switching, consider using a dedicated display manager instead of a window manager-only setup. Tools like sddm or gdm3 are designed to handle multiple concurrent login requests securely.
Configuring i3 for Better Session Management
While you cannot enable user switching from the lock screen, you can optimize i3wm to make logging out and switching users faster. This reduces the friction associated with returning to the display manager.
Ensure your ~/.config/i3/config file has a clear binding for exiting the session. For example:
bindsym $mod+Shift+e exec --no-startup-id i3-msg exitThis command gracefully terminates the i3 process, allowing the display manager to regain control immediately. You can also configure your system to automatically start the display manager after logout if it is set to auto-login or if you prefer a seamless transition.
Additionally, if you are using NetworkManager, ensure that network connections are managed globally so that new users do not need to reconfigure Wi-Fi or Ethernet settings upon login. This improves the experience for shared machines.
Understanding Session Isolation
Linux isolates user sessions to protect privacy and system stability. When User A is logged in, their processes run under their UID. User B cannot access User A’s files or running applications without explicit permissions. The lock screen enforces this isolation by preventing input events from reaching User A’s applications.
Attempting to bypass this isolation breaks the trust model of the operating system. There is no safe, supported way to configure i3wm to ignore this boundary. Administrators should educate users on the importance of locking their screens when leaving their desks and using proper logout procedures when sharing the machine.
For more information on managing system privileges safely, see Run Programs with Elevated Privileges: A Comprehensive Guide. Understanding how privileges work helps clarify why session locking cannot be easily circumvented.
Frequently Asked Questions
Can I use sudo to switch users from i3lock?
No, sudo cannot be used to switch users from a locked i3lock screen. Sudo elevates privileges for the current user but does not change the active X session or bypass the input lock. The lock screen intercepts all keyboard input, making it impossible to execute commands.
What happens if I press Ctrl+Alt+F2 while i3lock is active?
Pressing Ctrl+Alt+F2 switches to a virtual TTY console. This action typically kills the X server session or suspends it, depending on your distribution. You will see a text-based login prompt, but your graphical i3 session will be lost or paused, and other users can log in via TTY.
Is it possible to create a custom lock screen that allows user switching?
Creating a custom lock screen that allows user switching is technically feasible but highly discouraged due to security risks. Such a tool would need to hook into the display manager’s authentication service, which is complex and prone to vulnerabilities. Standard practice is to use the display manager for user selection.
How do I switch users without losing my work in i3wm?
You cannot switch users without closing your current session in i3wm. To preserve your work, save all open documents and then log out using i3-msg exit. Another user can then log in via the display manager. There is no suspend-to-RAM feature for individual users that allows concurrent GUI access.
Does enabling SSH allow remote user switching?
SSH allows remote command-line access but does not provide a graphical user switching interface. A remote user could potentially kill your X session or log in via TTY, but they cannot interact with your locked desktop graphically. This is not a substitute for local multi-user support.