Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a VM I am initializing I am able to log in as one non-root user (admin) but not another (tbbscraper) over SSH with public key authentication. The only error message I can find in any log file is

Sep 18 17:21:04 [REDACTED] sshd[18942]: fatal: Access denied for user tbbscraper by PAM account configuration [preauth]

On the client side, the syndrome is

$ ssh -v -i [REDACTED] tbbscraper@[REDACTED]
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: publickey
debug1: Next authentication method: publickey
debug1: Offering public key: [REDACTED]
debug1: Authentications that can continue: publickey
debug1: Trying private key: [REDACTED]
debug1: read PEM private key done: type RSA
Connection closed by [REDACTED]

Changing 'tbbscraper' to 'admin' allows a successful login: debug1: Authentication succeeded (publickey). appears instead of the "Connection closed" message.

This doesn't seem to be a permissions problem...

# for x in admin tbbscraper
> do ls -adl /home/$x /home/$x/.ssh /home/$x/.ssh/authorized_keys
> done
drwxr-xr-x 3 admin admin 4096 Sep 18 17:19 /home/admin
drwx------ 2 admin admin 4096 Sep 18 16:53 /home/admin/.ssh
-rw------- 1 admin admin  398 Sep 18 17:19 /home/admin/.ssh/authorized_keys
drwxr-xr-x 3 tbbscraper tbbscraper 4096 Sep 18 17:18 /home/tbbscraper
drwx------ 2 tbbscraper tbbscraper 4096 Sep 18 17:18 /home/tbbscraper/.ssh
-rw------- 1 tbbscraper tbbscraper  398 Sep 18 17:18 /home/tbbscraper/.ssh/authorized_keys

# cmp /home/{admin,tbbscraper}/.ssh/authorized_keys ; echo $?

... nor a PAM-level access control problem ...

# egrep -v '^(#|$)' /etc/security/*.conf

... so none of the existing answers to similar questions would seem to apply. The only other piece of evidence I've got is:

root@[REDACTED] # su - admin
admin@[REDACTED] $


root@[REDACTED] # su - tbbscraper
su: Authentication failure
tbbscraper@[REDACTED] $

which suggests some larger-scale PAM issue, but I can't find anything obviously wrong with the stuff in /etc/pam.d. Any ideas?

The VM is an EC2 instance, OS is Debian 7.1 (Amazon's off-the-shelf AMI).

share|improve this question
/etc/pam.d/sshd please – GioMac Sep 18 '13 at 17:47
@GioMac Never mind, I found the problem. – zwol Sep 18 '13 at 17:59
up vote 14 down vote accepted

After all that, it turns out to have been a one-character typo in /etc/shadow. Spot the difference:


That's right, there are two colons after the exclamation point on the tbbscraper line. That shoves all the fields over one and makes PAM think that the account expired on January 8, 1970.

share|improve this answer
Thanks for posting. This was useful for me: I'd manually created a user entry in /etc/passwd and forgotten to add a corresponding /etc/shadow entry. – spazm Jul 7 '14 at 19:07
@spazm Thanks for commenting. This was useful for me: I'd manually copied users from another machine and forgotten to copy the /etc/shadow entry of the one user without a password. – Jayen Jan 1 '15 at 5:49

I got the same problem this morning but the server authenticates users against Active Directory. Turns out the user's domain password had expired.

share|improve this answer
Same phenomenon, different source of user account information :-) It's possible that I should have filed a bug against ssh and/or PAM two years ago, asking for clearer logging of why a login attempt was denied; there is a security argument for not telling the person who made the attempt why it failed, but that wouldn't apply to system logs. – zwol Nov 11 '15 at 16:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.