2

Can not login to SLES server via ssh as user1. At the same time I can login as root user without any problem. Authentication method is password based. In /etc/ssh/sshd_config I have PasswordAuthentication yes.

node1:~ # ssh -v -v -v user1@node2 after entering password gives:

Password:
debug3: packet_send2: adding 32 (len 17 padlen 15 extra_pad 64)
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug2: userauth_kbdint
debug2: we sent a keyboard-interactive packet, wait for reply
debug2: input_userauth_info_req
debug2: input_userauth_info_req: num_prompts 1
Password:

The following log entries are present in the authorisation log file,

Jul 6 13:44:37 node2 sshd[23303]: pam_listfile(sshd:auth): Refused user user1 for service sshd 
Jul 6 13:44:39 node2 sshd[23294]: error: PAM: Authentication failure for user1 from node1
8
  • what is in your server ssh log? There must be a reason for denying authentication. Wrong password? Pam configuration?
    – Jakuje
    Jul 6, 2015 at 10:33
  • 2
    @Jakuje, Jul 6 13:44:37 node2 sshd[23303]: pam_listfile(sshd:auth): Refused user user1 for service sshd Jul 6 13:44:39 node2 sshd[23294]: error: PAM: Authentication failure for user1 from node1. Seems like pam_listfile have some list of barred users Jul 6, 2015 at 10:47
  • 2
    I found pam config /etc/pam.d/sshd which had the following line auth required pam_listfile.so item=user sense=deny file=/etc/sshdusers onerr=succeed. And in /etc/sshdusers my user1 was listed. I deleted user1, restarted sshd and it works. Jul 6, 2015 at 11:13
  • 1
    @YuraVasylenko glad it's working, when ServerFault allows you, you should come back and enter that as an answer, so it's detailed there rather than just as a comment. Jul 6, 2015 at 12:47
  • 1
    @EightBitTony There is nothing stopping users from answering their own question immediately. As far as I recall only accepting your own answer and putting a bounty on a question must wait until the question is at least 48 hours old.
    – kasperd
    Jul 7, 2015 at 11:29

1 Answer 1

2

The problem was in PAM configuration file for sshd daemon /etc/pam.d/sshd. The raw within /etc/pam.d/sshd:

auth  required pam_listfile.so item=user sense=deny file=/etc/sshdusers onerr=succeed 

means that pam_listfile module will deny sshd service for all users listed in /etc/sshdusers

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .