Red Hat Enterprise Linux 6.10 in VMWare virtual machine. We have several user accounts defined. One user account (user3) is unable to log in, either through SSH or the VMWare Console. It has logged in in the past, but for the last two days it has not been able to login. Other user accounts can log in with no issues.
The user's account is listed in /etc/passwd and /etc/shadow, and is not locked out. We created a new user, and that user logged in with no issues. The /etc/passwd entry shows a valid shell path (/bin/bash).
We deleted user3 and recreated the account. It still cannot log in. New accounts with any other name (usr3, user33, etc.) can log on. An account named user3 cannot log on.
If a new account gets the UID that user3 had, it can log in. If a new account named user3 has a different UID, it still cannot log in. Somewhere the display name 'user3' is locked out.
Running 'passwd user3' as root gives the following entries in /var/log/secure:
passwd: pam_unix(passwd:chauthtok): password changed for user3 passwd: gkr-pam: couldn't update the 'login' keyring password: no old password was entered
When we SSH in as user3, /var/log/secure shows:
sshd: error: PAM: Authentication failure for user3 from computer1
That's it. No other errors. Interestingly, when we intentionally enter an incorrect password, we see a differnt set of errors:
unix_chkpwd: password check failed for user (user3) sshspam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=computer1 user=user3 sshd: error: PAM: Authentication failure for user3 from computer1 sshd: error: PAM: Authentication failure for illegal user user3 from computer3
It appears to me that PAM has a corrupt entry for 'user3' somewhere. I don't know PAM well enough to troubleshoot further.
I need to avoid any solutions that wipe/reset the entire PAM configuration, as I don't want to affect other user accounts. How to pinpoint the 'user3' name?