Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a RedHat 5.3 server with several regular users created. Since last Friday the user "xpto" is getting "Authentication failed" error messages.

  • Tha account isn't locked out.
  • I have reset the user's password.
  • I have deleted and recreated the user "xpto" but the problem persists.

Using PuTTY, if the wrong password is entered I get prompted for the correct password. If I insert the correct password the session is immediately terminated.

What's wrong?

share|improve this question
3  
"Authentication failed" or gets logged out inmediately? There is a difference. What does system-config-users say about this account, specifically what shell does it use? Do other working accounts use the same shell/configuration? Did you keep the old account's $HOME? Somebody messed with .profile, .bash_login, .bashrc or some other files there? Try moving them out of the way (into a directory called SAVE or so in $HOME) and try again... –  vonbrand Feb 4 '13 at 13:16
    
are you using PAM (Pluggable Authentication Modules)? If so, try disabling it on server-side: set UsePAM no in /etc/ssh/sshd_config` (or weherever your config file is). –  peterph Feb 4 '13 at 14:30
    
On PuTTy it gets logged out inmediately. On WinSCP it gets a "authentication failed" message. –  GAR Feb 4 '13 at 15:51
    
I've deleted the user account and its home directory. All regular users have been created with the useradd comand. The user uses the bash shell. –  GAR Feb 4 '13 at 15:57
1  
Great! Please answer your own question, and accept it to close the issue. Thanks! –  vonbrand Feb 4 '13 at 17:09

1 Answer 1

You changed something in your configuration last Friday.

The first place to look is your system logs. I don't remember the default log file setup for Red Hat; one of the files in /var/log contains authentication logs (/var/log/auth.log, perhaps). More generally, look for log entries that date from the time of xpto's login attempts. You will probably need to be root to read those logs.

Check if anything has changed in xpto's home directory. Does it have the proper permissions? Does it have the proper ownership (if you deleted and created xpto, you might have changed the UID)? If you're using key authentication, do the home directory, the ~/.ssh directory and the ~/.ssh/authorized_keys all have acceptable permissions, i.e. only writable to the user (group-writable is not acceptable even if the user is alone in a group)?

Change if anything has changed about the user xpto, such as the location of the home directory or the login shell. Check that xpto's login shell is still executable, that the required libraries are still installed, and that the shell is still listed in /etc/shells.

Check your SSH configuration in /etc/sshd_config. If using PAM (UsePAM yes), check the PAM configuration in /etc/pam.conf and /etc/pam.d. Check if a Match directive in sshd_config applies to xpto (this could be a Match Group directive).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.