8

I am trying to setup a passwordless login from machineA to machineB for my user david which already exits. This is what I did to generate the authentication keys:

david@machineA:~$ ssh-keygen -t rsa
........

david@machineB:~$ ssh-keygen -t rsa
........

After that I copied id_rsa.pub (/home/david/.ssh/id_rsa.pub) key of machineA into machineB authorized_keys file (/home/david/.ssh/authorized_keys) key.

And then I went back to machineA login screen and ran below command and it worked fine without any issues. So I was able to login into machineB as david user without asking for any password.

david@machineA:~$ ssh david@machineB

Question:

Now I created a new user on machineA and machineB both by running this command only useradd golden. And now I want to ssh passwordless from this golden user into machineB from machineA. I did same exact step as above but it doesn't work.

david@machineA:~$ sudo su - golden
golden@machineA:~$ ssh-keygen -t rsa
........

david@machineB:~$ sudo su - golden
golden@machineB:~$ ssh-keygen -t rsa
........

And then I copied id_rsa.pub key /home/golden/.ssh/id_rsa.pub for golden user from machineA to machineB authorized_keys file /home/golden/.ssh/authorized_keys. And when I try to ssh, it gives me:

golden@machineA:~$ ssh golden@machineB
Connection closed by 23.14.23.10

What is wrong? It doesn't work only for golden user which I created manually through this command useradd. I am running Ubuntu 14.04. Is there any settings that I need to enable for this manual user which I created?

In the machineB auth.log file, below is what I am seeing when I run this command from machineA ssh -vvv golden@machineB to login

Jan  3 17:56:59 machineB sshd[25664]: error: Could not load host key: /etc/ssh/ssh_host_ed25519_key
Jan  3 17:56:59 machineB sshd[25664]: pam_access(sshd:account): access denied for user `golden' from `machineA'
Jan  3 17:56:59 machineB sshd[25664]: pam_sss(sshd:account): Access denied for user golden: 10 (User not known to the underlying authentication module)
Jan  3 17:56:59 machineB sshd[25664]: fatal: Access denied for user golden by PAM account configuration [preauth]

Is there anything I am missing? Below is how my directory structure looks like:

golden@machineA:~$ pwd
/home/golden
golden@machineA:~$ ls -lrtha
total 60K
-rw------- 1 golden golden  675 Nov 22 12:26 .profile
-rw------- 1 golden golden 3.6K Nov 22 12:26 .bashrc
-rw------- 1 golden golden  220 Nov 22 12:26 .bash_logout
drwxrwxr-x 2 golden golden 4.0K Nov 22 12:26 .parallel
drwxr-xr-x 2 golden golden 4.0K Nov 22 12:34 .vim
drwxr-xr-x 7 root     root     4.0K Dec 22 11:56 ..
-rw------- 1 golden golden  17K Jan  5 12:51 .viminfo
drwx------ 2 golden golden 4.0K Jan  5 12:51 .ssh
drwx------ 5 golden golden 4.0K Jan  5 12:51 .
-rw------- 1 golden golden 5.0K Jan  5 13:14 .bash_history


golden@machineB:~$ pwd
/home/golden
golden@machineB:~$ ls -lrtha
total 56K
-rw------- 1 golden golden  675 Dec 22 15:10 .profile
-rw------- 1 golden golden 3.6K Dec 22 15:10 .bashrc
-rw------- 1 golden golden  220 Dec 22 15:10 .bash_logout
drwxr-xr-x 7 root     root     4.0K Jan  4 16:43 ..
drwx------ 2 golden golden 4.0K Jan  5 12:51 .ssh
-rw------- 1 golden golden 9.9K Jan  5 12:59 .viminfo
drwx------ 6 golden golden 4.0K Jan  5 12:59 .
-rw------- 1 golden golden 4.6K Jan  5 13:10 .bash_history

Update:

In machineA:

cat /etc/passwd | grep golden
golden:x:1001:1001::/home/golden:/bin/bash

In machineB:

cat /etc/passwd | grep golden
golden:x:1001:1001::/home/golden:/bin/bash
  • Could you show /etc/passwd entry for the user? – pbm Jan 5 '17 at 22:55
  • updated the question with the details. One thing is firstly I created user without any password and then later on I created the password for this golden user after some time. – user5447339 Jan 5 '17 at 23:00
  • Pam_sss is giving user unknown. You need to verify, how sssd is configured on your system. Some cases sssd is configured to cache credentials, so you may have to invalidate cache/restart sssd – VenkatC Jan 6 '17 at 0:26
  • @VenkatC How can I restart sssd in my system? These are all VM so I am not sure how it was configured as we got this system from some other team. – user5447339 Jan 6 '17 at 0:32
  • sysyemctl restart sssd - should work on systemd based server – VenkatC Jan 6 '17 at 0:40
11

The issue is with PAM stack configuration. Your host is configured with pam_access and default configuration is not allowing external/SSH access for the new user golden ,even though your keys are setup properly.

Adding golden user into /etc/security/access.conf as below fixed the issue.

+:golden:ALL

To see more information readman access.conf which explains each field of this file. Look at examples section to understand the order and meanings of LOCAL, ALL etc

6

I had the same issue and none of suggested options worked. But I found in one of forums (https://ubuntuforums.org/showthread.php?t=1960510) a "workaround" which worked perfectly.

Edit /etc/ssh/sshd_config and set

UsePAM no

While it's probably not the real solution, because something is definitely wrong with my machine (yesterday it was working fine!), this one at least works.

-3

Please add the following in /etc/security/access.conf:

-:ALL:EXCEPT root
  • 3
    Welcome to Unix.SE! Could you edit your answer to explain how it’s better than the existing answers? – Stephen Kitt Jan 8 at 15:04
  • @StephenKitt I tried both the above answers, but they didn't work for me. When I add the -:ALL:EXCEPT root in /etc/security/access.conf, it started working. – IRSHAD AHMED MOHAMMED Jan 8 at 19:55
  • Please try to restart winbindd and oddjobd. Hope it will help. Thanks, – IRSHAD AHMED MOHAMMED Jan 8 at 20:31
  • 1
    @IRSHADAHMEDMOHAMMED Can you explain why it worked and what other security-related consequences this would have? – Kusalananda Oct 24 at 21:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.