I have a corporate network with an OpenLDAP installed and functional.

I can log in a Linux server in this network using ssh with my profile (user) that is in OpenLDAP.

I created a new user with exactly the same accesses my user owns. However I can not log in the Linux Server using ssh with this new user.

My question: What methods can I take to diagnose what is happening?

NOTE I: All environments considered in this question are Linux.
NOTE II: I know the question is a bit vague. But at the moment I do not even know where to start to solve this problem.

  • 1
    Look for the error log on the target server. Maybe the home directory is missing. Or credentials are cached.
    – RalfFriedl
    Aug 29, 2018 at 18:20
  • 1
    I'm assuming that you created the second user in ldap also. What does /var/log/secure or /var/log/auth report?
    – doneal24
    Aug 29, 2018 at 18:23

1 Answer 1


To get the problem diagnosed I used the log file...

less +F /var/log/auth.log

... that told me the following problem...

Aug 29 15:11:35 debian03 sshd[14537]: User userlogin from XXX.XXX.XXX.78 not allowed because not listed in AllowUsers
Aug 29 15:11:35 debian03 sshd[14537]: input_userauth_request: invalid user userlogin [preauth]
Aug 29 15:11:36 debian03 sshd[14537]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=XXX.XXX.XXX.78  user=userlogin
Aug 29 15:11:36 debian03 sshd[14537]: pam_ldap: error trying to bind as user "cn=User Name,ou=usuarios,dc=domainname,dc=com,dc=br" (Invalid credentials)
Aug 29 15:11:37 debian03 sshd[14537]: Failed password for invalid user userlogin from XXX.XXX.XXX.78 port 13098 ssh2
Aug 29 15:11:45 debian03 sshd[14537]: Connection closed by XXX.XXX.XXX.78 [preauth]
Aug 29 15:11:49 debian03 sshd[14542]: Received disconnect from XXX.XXX.XXX.165: 11:  [preauth]

The solution was add the user "userlogin" between the users of "AllowUsers" in the file...

vi /etc/ssh/sshd_config

... and restart the ssh service...

/etc/init.d/ssh restart

Thanks! =D

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .