I'm currently trying to configure a system where the initial install was done by someone else.
I could ssh into the box, and while on it, added some groups to me account and changed my password (I still have that session open, and have root access via sudo -i
). I was told "passwd: all authentication tokens updated successfully.". However on attempting a second connection I get "permission denied".
I have reset the password again (typing very carefully) and tried to login again (typing very carefully). But still the same.
The account is not locked (at least usermod -U has no impact and there is no '!' in the shadow file). I am not attempting to login as root. There is no /etc/nogin
My shell has not been changed from /bin/bash
So I could still access the machine, I copied over my public key to ~/.ssh/authorized_keys. Attempting to login using that bumps me to the password prompt - which continues to fail.
This is a RHEL 6.5 box
The audit log (selinux mode is permissive) seems to be pointing towards the password failing:
type=USER_AUTH msg=audit(1455985417.050:170881): user pid=23682 uid=0 auid=0 ses=1548 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:authentication acct="user" exe="/usr/sbin/sshd" hostname=192.168.1.81 addr=192.168.1.81 terminal=ssh res=failed'
type=SYSCALL msg=audit(1455985417.051:170882): arch=c000003e syscall=2 success=yes exit=4 a0=7fdafebb7e30 a1=401 a2=7fdafebb2366 a3=0 items=1 ppid=28418 pid=23682 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1548 comm="sshd" exe="/usr/sbin/sshd" subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 key="session"
type=CWD msg=audit(1455985417.051:170882): cwd="/"
type=PATH msg=audit(1455985417.051:170882): item=0 name="/var/log/btmp" inode=41 dev=fd:05 mode=0100600 ouid=0 ogid=22 rdev=00:00 obj=system_u:object_r:faillog_t:s0 nametype=NORMAL
type=USER_AUTH msg=audit(1455985417.052:170883): user pid=23682 uid=0 auid=0 ses=1548 subj=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=password acct="(unknown)" exe="/usr/sbin/sshd" hostname=? addr=192.168.1.81 terminal=ssh res=failed'
/var/log/secure
contains information and reasons about failedssh
logins.sshd_config
asSyslogFacility
? How isrsyslog
configured to handle that facility?rsyslog
running? Didn't you change some configuration insshd_config
?