0

I've check the similar post but none really helping. Anyone have idea about this?


Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug1: matching key found: file /home/user/.ssh/authorized_keys, line 32 RSA SHA256:Pi4vjWY1TtjIPyP9Ot5opdnbDeB0BtasQ9jaKMQgu3Y
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug1: restore_uid: 0/0
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_answer_keyallowed: key 0x55e87e9ea3a0 is allowed
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_request_send entering: type 23
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_key_verify entering [preauth]
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_request_send entering: type 24 [preauth]
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_key_verify: waiting for MONITOR_ANS_KEYVERIFY [preauth]
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_request_receive_expect entering: type 25 [preauth]
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_request_receive entering [preauth]
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_request_receive entering
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: monitor_read: checking request 24
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_answer_keyverify: key 0x55e87e9e9c70 signature verified
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_request_send entering: type 25
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_request_receive_expect entering: type 102
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_request_receive entering
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug1: do_pam_account: called
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: PAM: do_pam_account pam_acct_mgmt = 7 (Authentication failure)

<- why this fail?

Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_request_send entering: type 103
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: Failed publickey for user from 10.96.4.107 port 63266 ssh2: RSA SHA256:Pi4vjWY1TtjIPyP9Ot5opdnbDeB0BtasQ9jaKMQgu3Y
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug2: userauth_pubkey: authenticated 1 pkalg ssh-rsa [preauth]
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_do_pam_account entering [preauth]
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_request_send entering: type 102 [preauth]
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_request_receive_expect entering: type 103 [preauth]
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_request_receive entering [preauth]
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_do_pam_account returning 0 [preauth]
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: fatal: Access denied for user user by PAM account configuration [preauth]
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug1: do_cleanup [preauth]
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: PAM: sshpam_thread_cleanup entering [preauth]
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_request_send entering: type 124 [preauth]
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_request_send entering: type 122 [preauth]
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_request_receive_expect entering: type 123 [preauth]
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_request_receive entering [preauth]
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_request_receive entering
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: monitor_read: checking request 124
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_request_receive entering
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: monitor_read: checking request 122
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_request_send entering: type 123
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug1: monitor_read_log: child log fd closed
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: mm_request_receive entering
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug1: do_cleanup
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug1: PAM: cleanup
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug3: PAM: sshpam_thread_cleanup entering
Nov 20 13:08:06 ip-10-160-153-99 sshd_server[10408]: debug1: Killing privsep child 10409
Improve this question

2 Answers 2

Reset to default
1

It's not failing authentication, it's failing authorization. That's a completely separate set of checks – even though you have authenticated successfully, the server thinks you are not allowed to log in for other reasons (e.g. disallowed source address, missing group membership, missing LDAP attributes, and so on).

Take a look at the modules in the account section of /etc/pam.d/sshd, as well as any included files. Usually the modules will also log any rejections to syslog.

Improve this answer
1
  • Thanks a lot for getting back, below is the account section, which look normal: account required pam_nologin.so ; account include password-auth There are those setting look unfamiliar, not sure if those causing problem? # Used with polkit to reauthorize users in remote sessions ; -auth optional pam_reauthorize.so prepare ; # Used with polkit to reauthorize users in remote sessions ; -session optional pam_reauthorize.so prepare
    – Carfield Yim
    Nov 22, 2020 at 14:37
1

I found out what was the problem. The SSH process is missing from /etc/pam.d. After adding the entry, it is working.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .