I have a debian bullseye headless home server. I recently found out about, and installed, selinux. I have been reading multiple wiki and tutorials to learn how it works and how to configure it. I have set up pam to allow logins from the local network as usual but to require TFA on remote logins. I have selinux config set to permissive but had changed it to enforcement mode with setenforce 1 while logged in via ssh on my local network.

The problem being I am now trying to ssh remotely and it is rejecting TFA, so I have no way to undo it. I won't have physical access to the server for another week to be able to reboot it back into permissive mode to trouble shoot.

Is rebooting the only way to fix this or is my novice brain missing something?

1 Answer 1


In the end I was able to get someone to pull the plug on the server to reboot, so no remote method, which is good really as it would have defeated the point of the security.

When making changes to the file contexts to allow 2FA to work. I just ran sleep 5m && reboot now in case I locked myself out again if my open ssh session disconnected.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .