Arch Linux

skrat

Member

Registered: 2013-05-10

Posts: 39

Can't login with password, PAM/SSH fail

Hi, I have freshly installed server, on Linode, I used arch 2012.10 template. Then I tried to upgrade `pacman -Syu` but there was issue with existing /bin etc., infamous filesystem package upgrade. I worked around by using ARM, first upgrading to 2013.01 then to 2013.03 and finally using latest repo. Before I did the upgrade, I copied my ssh key to the server and from there on I pubkey authentication to login. Later on I realized I need to login from various locations and I need to have password authentication as well. But that doesn't work. I use default PAM (/etc/pam.d) and SSH (/etc/ssh/sshd_config) configuration. This is what I get at LogLevel DEBUG3:

Jun 10 13:57:08 svali sshd[17069]: debug3: mm_request_receive entering [preauth]
Jun 10 13:57:08 svali sshd[17069]: debug3: mm_request_receive entering
Jun 10 13:57:08 svali sshd[17069]: debug3: monitor_read: checking request 12
Jun 10 13:57:08 svali sshd[17069]: debug3: PAM: sshpam_passwd_conv called with 1 messages
Jun 10 13:57:11 svali sshd[17069]: debug1: PAM: password authentication failed for skrat: Authentication failure
Jun 10 13:57:11 svali sshd[17069]: debug3: mm_answer_authpassword: sending result 0
Jun 10 13:57:11 svali sshd[17069]: debug3: mm_request_send entering: type 13
Jun 10 13:57:11 svali sshd[17069]: Failed password for skrat from 188.167.200.112 port 43520 ssh2
Jun 10 13:57:11 svali sshd[17069]: debug3: mm_auth_password: user not authenticated [preauth]
Jun 10 13:57:11 svali sshd[17069]: debug3: userauth_finish: failure partial=0 next methods="publickey,password" [preauth]

I'm absolutely clueless. I checked the password with `passwd` utility, it's all correct. What else can I do?

ewaller

Administrator

From: Pasadena, CA

Registered: 2009-07-13

Posts: 20,354

Re: Can't login with password, PAM/SSH fail

I am a little out of me league here, but are there any pam messages in the journal as to why it failed? 

Can you su to skrat after making a pubkey connection/login?

---

Nothing is too wonderful to be true, if it be consistent with the laws of nature -- Michael Faraday
Sometimes it is the people no one can imagine anything of who do the things no one can imagine. -- Alan Turing
---
How to Ask Questions the Smart Way

skrat

Member

Registered: 2013-05-10

Posts: 39

Re: Can't login with password, PAM/SSH fail

Yes I can su to that account. There are no messages under pam unit, pam alone doesn't seem to be logging. It could though, at least which module return a failure during authentication.

skrat

Member

Registered: 2013-05-10

Posts: 39

Re: Can't login with password, PAM/SSH fail

I thought that perhaps some configuration incompatibility occurred during the upgrade, but this doesn't seem to be the case

~ » find /etc -name "*.pacnew"
/etc/group.pacnew
/etc/pacman.d/mirrorlist.pacnew
find: `/etc/sudoers.d': Permission denied
/etc/gshadow.pacnew
/etc/passwd.pacnew
/etc/fstab.pacnew
/etc/shadow.pacnew
/etc/locale.gen.pacnew

skrat

Member

Registered: 2013-05-10

Posts: 39

Re: Can't login with password, PAM/SSH fail

When I set

UsePAM no

then it works. How can I debug PAM then? I swear I have the default PAM configuration, what could be wrong?

samos123

Member

Registered: 2012-04-25

Posts: 8

Re: Can't login with password, PAM/SSH fail

I can only confirm that I have the same issue setting UsePAM no would enable password based authentication. Will try if I can find out some more.

capleton

Member

Registered: 2010-07-01

Posts: 18

Re: Can't login with password, PAM/SSH fail

Are you using ZSH by any chance?

skrat

Member

Registered: 2013-05-10

Posts: 39

Re: Can't login with password, PAM/SSH fail

Yes I am, on both ends.

samos123

Member

Registered: 2012-04-25

Posts: 8

Re: Can't login with password, PAM/SSH fail

Just to confirm me too on both ends.

capleton

Member

Registered: 2010-07-01

Posts: 18

Re: Can't login with password, PAM/SSH fail

See this

and this

Looks like changing the remote login shell to BASH is the workaround for now.