Linux User not able to login

Question

I am trying to create new users using useradd command using root credentials it is getting created properly but when I log in with the newly created user with its credentials using a PuTTY Console, I am able to enter the username but when I give the password, it hangs there for a long time until the PuTTY window session timeout happens and the window is closed. However when I use root credentials, it quickly enters the session.

I tried checking the AllowUsers under file /etc/ssh/sshd_config but I didn't find any matching entry, so, I manually tried adding AllowUsers temipuser where temipuser is the username I created. Post making this change from another PuTTY Console I again tried entering this username but it is again the same. I am totally clueless why is this happening.

Another thing is, if I add any user, say just temipuser, to the AllowUsers entry in the sshd_config file, will the root user still have access or will it not get access? I don't want to screw the things here. I understand AllowUsers lets only the specified users and denies others.

Answer 1

look for any relevant entries under /var/log/secure or /var/log/auth.log. Also, make sure that you don't have custom rules added under /etc/security/access.conf which might access to the server for that user.

Those logs will contain information about failed logins and may indicate clearly what went wrong.

The /etc/security/access.conf file specifies (user/group, host), (user/group, network/netmask) or (user/group, tty) combinations for which a login will be either accepted or refused.

Answer 2

Next to adding the user on the Linux machine, you'll have to generate a key (protocol type 2, preferably RSA) for that user as well. You can find instructions for that using Putty's key generator here.

Select all of the text in the ‘Public key for pasting into authorized_keys file’ box in putty's key generator, paste it into a text editor and save it under the name authorized_keys.

In the home directory of the new user on the Linux machine, create a .ssh directory if it doesn't exist. This directory should be owned by the user, and only that user should have access to it (chmod 700 .ssh) Copy the authorized_keys file to this directory. You should change the permissions of that file with chmod 0600, and change ownership to the user.

Now the user should be able to log in.

Answer 3

Before trying these commands, either you need to become root user or you will have to run commands with sudo.

After each change in file /etc/ssh/sshd_config, you need to restart ssh service. Command is:

systemctl restart  sshd.service

Any new user with which you want to do ssh login with password, you need to add that user to AllowUsers with space as separator for each user.

Eg:
AllowUsers root testUser

For root user to be active in login through ssh, you need to check PermitRootLogin, its value should be yes in file /etc/ssh/sshd_config

For Example: check the below sshd_config file. With this configuration you can also do ssh login using testUser and root user:

#       $OpenBSD: sshd_config,v 1.100 2016/08/15 12:32:04 naddy Exp $

# This is the sshd server system-wide configuration file.  See
# sshd_config(5) for more information.

# This sshd was compiled with PATH=/usr/bin:/bin:/usr/sbin:/sbin

# The strategy used for options in the default sshd_config shipped with
# OpenSSH is to specify options with their default value where
# possible, but leave them commented.  Uncommented options override the
# default value.

#Port 22
#AddressFamily any
#ListenAddress 0.0.0.0
#ListenAddress ::

#HostKey /etc/ssh/ssh_host_rsa_key
#HostKey /etc/ssh/ssh_host_ecdsa_key
#HostKey /etc/ssh/ssh_host_ed25519_key

# Ciphers and keying
#RekeyLimit default none

# Logging
#SyslogFacility AUTH
#LogLevel INFO

# Authentication:

#LoginGraceTime 2m
PermitRootLogin yes
#StrictModes yes
#MaxAuthTries 6
#MaxSessions 10

#PubkeyAuthentication yes

# Expect .ssh/authorized_keys2 to be disregarded by default in future.
#AuthorizedKeysFile     .ssh/authorized_keys .ssh/authorized_keys2

#AuthorizedPrincipalsFile none

#AuthorizedKeysCommand none
#AuthorizedKeysCommandUser nobody

# For this to work you will also need host keys in /etc/ssh/ssh_known_hosts
#HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for
# HostbasedAuthentication
#IgnoreUserKnownHosts no
# Don't read the user's ~/.rhosts and ~/.shosts files
#IgnoreRhosts yes

# To disable tunneled clear text passwords, change to no here!
#PasswordAuthentication yes
#PermitEmptyPasswords no

# Change to yes to enable challenge-response passwords (beware issues with
# some PAM modules and threads)
ChallengeResponseAuthentication no

# Kerberos options
#KerberosAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no

# GSSAPI options
#GSSAPIAuthentication no
#GSSAPICleanupCredentials yes
#GSSAPIStrictAcceptorCheck yes
#GSSAPIKeyExchange no

# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication.  Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
UsePAM yes

#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes
PrintMotd no
#PrintLastLog yes
#TCPKeepAlive yes
#UseLogin no
#UsePrivilegeSeparation sandbox
#PermitUserEnvironment no
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
#UseDNS no
#PidFile /var/run/sshd.pid
#MaxStartups 10:30:100
#PermitTunnel no
#ChrootDirectory none
#VersionAddendum none

# no default banner path
#Banner none

# Allow client to pass locale environment variables
AcceptEnv LANG LC_*

# override default of no subsystems
Subsystem       sftp    /usr/lib/openssh/sftp-server

# Example of overriding settings on a per-user basis
#Match User anoncvs
#       X11Forwarding no
#       AllowTcpForwarding no
#       PermitTTY no
#       ForceCommand cvs server
AllowUsers root testUser

Answer 4

To me, your problem could be be related to a permission issue, since SSH asks you for a login (so it is not a port problem), and a password (so PasswordAuthentication is set to yes, which is the default anyway).

Indeed, the way sshd works by default is that it attempts reading public SSH keys before asking for a password, and if your ~/.ssh/authorized_keys has the wrong permissions, well, the manual says that sshd will not allow you to login (see below).

With no other information about your sshd configuration (is AuthorizedKeysFile still commented; do you actually use SSH keys; etc.), my guess was made by reading the sshd manual:

 ~/.ssh/authorized_keys
        Lists the public keys (DSA/ECDSA/RSA) that can be used for logging in as this user.
        The format of this file is described above.  The content of the file is not highly
        sensitive, but the recommended permissions are read/write for the user, and not
        accessible by others.

        If this file, the ~/.ssh directory, or the user's home directory are writable by
        other users, then the file could be modified or replaced by unauthorized users.  In
        this case, sshd will not allow it to be used unless the StrictModes option has been
        set to “no”.

So. Can you ls -l ~/.ssh/autorized_keys and double-check that only the user can read that file?

To make sure nobody but the user can read this directory, use this: chmod -v a-w,u+w ~/.ssh/authorized_keys. Option -v is for chmod to inform you of the changes it made (if any), a-w,u+w is to remove the write permissions for all, and then give the user write permissions back.

Answer 5

Did you test adduser temipuser instead of useradd temipuser ???

linux manual for sshd_conf said:

AllowUsers

    This keyword can be followed by a list of user name patterns, separated by 
spaces. If specified, login is allowed only for user names that match one of the 
patterns. Only user names are valid; a numerical user ID is not recognized. **By 
default, login is allowed for all users.** If the pattern takes the form USER@HOST 
then USER and HOST are separately checked, restricting logins to particular users 
from particular hosts. The allow/deny directives are processed in the following 
order: DenyUsers, AllowUsers, DenyGroups, and finally AllowGroups.

So you don't have to add AllowUsers and if you add this option I don't think it prevent from remote root login if you enabled PermitRootLogin

Answer 6

Check the /etc/ssh/sshd_config file. Check if the "PasswordAuthentication" line is set to "no". Change this to "yes" and save the file. You have to do this as sudo. Once file is saved restart using command "sudo service ssh restart"

Answer 7

Remove any failures login counts , reset with below command:

pam_tally2 --reset -u username

use this command to null the entries

cp /dev/null /var/log/lastlog