I’m getting out of ideas. I don’t see a clear pattern here.
About the locking. Even if you have other problem, according to your logs the user is being locked. So check that also when you make your tests.
Thank you for your help! I won’t close this thread yet. To be sure I changed the values in /etc/security/faillock.conf to a more ‘secure’ setting 
and will watch it. I will report if there are any changes that fall out of the pattern.
Thx again!
It could be any number of reasons - I will list what comes to mind
- autologin behaves strange
- check display manager configuration
- never replace
- /etc/shadow with any .pacnew file
- /etc/passwd with any .pacnew file
- ssh behaving strange
- check port forwarding in router
- default ssh allows root:password logins
- never use password login but key-file
- change default port
- check the ssh identity (ssh fingerprint)
- remote access software behaves strange
- check with your documentation what changes you have made
- check with the vendor configurations
- default sometimes change
- if you are using default they will be replaced by the new config
- check the new configs if applicable
- verify the ssh fingerprint - if applicable
EDIT:
- if using fail2ban
- check the fail2ban log
- it could be as simple as typo too many times - bam - IP denied
- I know this from experience - took me a while to realize
- check the fail2ban log
I have problems with gkr-pam on my laptop that are related to a bug. Locking of the screen even if that is disabled and someone else was not able to login. There is a bug report more than a year old.
I learnt that the hard way some while ago…
Always a non-standard port that is not the same as the also non-standard port on the machine.
I always disable PW access via SSH as well as root access.
Thx for your input!
Don’t know if you are using something like above - worth checking though
Will do, the machine is off at the moment.
Apologies for opening this thread again, but I am facing the same problem. No typos. I haven’t logged in remotely but I face this problem when I am using sudo or when the screen is locked. Did anybody find a solution to this? I tried checking everything just like OP, but I can’t figure it out.