Session terminates immediately after authentication

Question

I have a RedHat 5.3 server with several regular users created. Since last Friday the user "xpto" is getting "Authentication failed" error messages.

• Tha account isn't locked out.
• I have reset the user's password.
• I have deleted and recreated the user "xpto" but the problem persists.

Using PuTTY, if the wrong password is entered I get prompted for the correct password. If I insert the correct password the session is immediately terminated.

What's wrong?

Answer 1

You changed something in your configuration last Friday.

The first place to look is your system logs. I don't remember the default log file setup for Red Hat; one of the files in /var/log contains authentication logs (/var/log/auth.log, perhaps). More generally, look for log entries that date from the time of xpto's login attempts. You will probably need to be root to read those logs.

Check if anything has changed in xpto's home directory. Does it have the proper permissions? Does it have the proper ownership (if you deleted and created xpto, you might have changed the UID)? If you're using key authentication, do the home directory, the ~/.ssh directory and the ~/.ssh/authorized_keys all have acceptable permissions, i.e. only writable to the user (group-writable is not acceptable even if the user is alone in a group)?

Change if anything has changed about the user xpto, such as the location of the home directory or the login shell. Check that xpto's login shell is still executable, that the required libraries are still installed, and that the shell is still listed in /etc/shells.

Check your SSH configuration in /etc/sshd_config. If using PAM (UsePAM yes), check the PAM configuration in /etc/pam.conf and /etc/pam.d. Check if a Match directive in sshd_config applies to xpto (this could be a Match Group directive).