I am trying to virtualize an old linux server, and the PtoV software requires a password login as root via ssh. However, the root login is being prevented with a "Permission Denied" error on the client end, and a "Failed Password for root" on the server end (when sshd is running in debug mode).

I HAVE set PermitRootLogin yes in /etc/ssh/sshd_config.

This is an old RedHat 7.3 server that has had hardening scripts like Bastille run on it years and years ago, and has many remnants of old OS's (like ipchains - no longer supported by the kernel) lying around. All to say I have little idea what has been altered from the original system, but there is a lot.

  • I can log in fine as root from the console
  • I can su to root fine from within the console or ssh session
  • I can ssh fine as a regular user.

My question is: What else could be preventing my root login on this server?

More information: /etc/pam.d/sshd

 auth       required     pam_stack.so service=system-auth
 auth       required     pam_nologin.so
 account    required     pam_stack.so service=system-auth
 password   required     pam_stack.so service=system-auth
 session    required     pam_stack.so service=system-auth
 session    required     pam_limits.so
 session    optional     pam_console.so


auth        required      /lib/security/pam_env.so
auth        sufficient    /lib/security/pam_unix.so likeauth nullok
auth        required      /lib/security/pam_deny.so
account     required      /lib/security/pam_unix.so
password    required      /lib/security/pam_cracklib.so retry=3 type=
password    sufficient    /lib/security/pam_unix.so nullok use_authtok md5 shadow
password    required      /lib/security/pam_deny.so
session     required      /lib/security/pam_limits.so
session     required      /lib/security/pam_unix.so

Can anybody tell me if the hashing algorithm could be the culprit? Keeping in mind that I can log in as an unprivileged user.

  • Check the SSH log to see if it sheds any info? Also the auth log if your system has one. – Chris S Oct 19 '10 at 18:58

Turns out the /etc/init.d/sshd script had no $OPTIONS variable, which would be the reference to the config file. Therefore sshd was starting without any config file at all, and hence, defaulting to "PermitRoodLogin no".

I resolved this by adding the following line near the start of /etc/init.d/sshd:

OPTIONS="-f /etc/ssh/sshd_config"

Hope this helps somebody else.

| improve this answer | |

Login as root via ssh could be disabled in the PAM configuration.

| improve this answer | |
  • Okay, I don't really understand PAM - is it possible to configure sshd to ignore PAM? (note, I tried a working sshd_config file from another machine, and it contained "UsePAM yes" - but sshd didn't recognize that directive) – Brent Oct 19 '10 at 16:33
  • Ignoring PAM is almost always the wrong thing to do. Look in /etc/pam.d/sshd to see if anything stands out. – Ignacio Vazquez-Abrams Oct 19 '10 at 16:35
  • Doesn't appear to, but I have posted the relevant pam configs. Does anything stand out to you? – Brent Oct 19 '10 at 17:01
  • No, that all looks perfectly normal and non-root-blocking. – Ignacio Vazquez-Abrams Oct 19 '10 at 17:03

I had the same problem, I can authenticate with any user but when I'm trying with root I get this message "access denied". The problem was solved by disabling UsePAM yes in /etc/ssh/sshd_config.

Change UsePAM yes to #UsePAM yes

| improve this answer | |

To expand on what Ignacio said, I'm guessing you are using pam_securetty and the ttys aren't in /etc/securetty. I don't recall what the tty names are in RH7.3. Ssh in as a normal user and run who to see the naming system.

| improve this answer | |
  • Okay - tty1 and tty2. go on... (these ARE listed in /etc/securetty) – Brent Oct 19 '10 at 16:43
  • Oops - I was wrong. They are pts/0, pts/1, etc. I have added those entries to /etc/securetty, but to no avail. I am still being blocked. – Brent Oct 19 '10 at 17:11

Following on from embobo, I happily (!) have a big cluster of RH73 boxes I'm not allowed to upgrade. They tell me that remote logins are on pts/0, pts/1, pts/2 and so on.

Could you try adding those to /etc/securetty and see if that improves matters? Probably best to add them as far as (say) pts/9, depending on how many other users are usually logged in.

| improve this answer | |
  • Okay, thank you. I mis-read the output of who - they ARE pts/0, pts/1, etc. Unfortunately, adding those and restarting ssh didn't resolve the situation. Can you explain what /etc/securetty does? – Brent Oct 19 '10 at 17:07
  • Can you post your /etc/pam.d/sshd and /etc/pam.d/system-auth? – Mark Wagner Oct 19 '10 at 17:13
  • Yes, I posted them above. – Brent Oct 19 '10 at 17:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.