:You cannot log on to the ECS instance of the Linux by using the correct password

Problem description

When you use SSH to connect to an ECS instance of the Linux, you cannot log on to the ECS instance even if you enter the correct password. When the problem occurs, an error may occur when you use the management terminal or SSH to log on to the client. Errors similar to the following are also found in the secure log.

• sshd[1199]: pam_listfile(sshd:auth): Refused user root for service sshd

• sshd[1199]: Failed password for root from 192.X.X.1 port 22 ssh2

• sshd[1204]: Connection closed by 192.X.X.2

Cause

PAM module (pam_listfile.so) related access control policies cause user login to fail.

Solution

PAM module can be used for Linux access control. To resolve this issue, please check the configuration as follows. The Linux configurations and descriptions in this article have been tested in CentOS 6.5 64-bit operating systems. The configurations of other operating systems may be different. For more information, see the official documentation of the operating system.

1. Log on to the instance and call cat or other commands to view the PAM configuration file. The following table describes the configuration files.

   File	Features
   /etc/pam.d/login	Configuration file corresponding to the console (management Terminal)
   /etc/pam.d/sshd	Corresponding configuration file for SSH logon
   /etc/pam.d/system-auth	System global configuration file

   Verify that the following configurations exist.

   auth required pam_listfile.so item=user sense=allow file=/etc/ssh/whitelist onerr=fail

2. These policies can improve server security. We recommend that you back up your files before making any modifications. The relevant policy parameters are described as follows.

   • item: The object type for access control. Valid values: tty, user, rhost, ruser, group, and shell.

   • sense: find the control method for matching items in the configuration file. Valid values: allow and deny. allow indicates a whitelist, and deny indicates a blacklist.

   • file: specifies the full path of the configuration file.

   • onerr: defines the default return value returned when an error occurs. For example, the configuration file cannot be opened.

3. Use an editor such as vi to delete the policy configuration, and you can also comment on the policy configuration, as shown below, add #.

   #auth required pam_listfile.so item=user sense=allow file=/etc/ssh/whitelist onerr=fail

4. Then log on to the server again and confirm that there is no exception.

References

• PAM(Pluggable Authentication Modules) is an Authentication mechanism proposed by Sun. It separates the service provided by the system from the authentication method of the service by providing some dynamic link libraries and a set of unified APIs. Therefore, the system administrator can flexibly configure different authentication methods for different services according to the requirements, without changing the service program, and it is also convenient to add new authentication methods to the system.

• Each application with PAM module enabled has a configuration file with the same name in the /etc/pam.d directory. For example, the configuration file of the login command is /etc/pam.d/login. You can configure a specific policy in the corresponding configuration file.

• For more information about pam_listfile, visit the following link, see linux-pam.org official documentation. pam_listfile

• If the problem persists, seeguidelines for troubleshooting failure to remotely log on to a Linux instance through SSH for further troubleshooting and analysis.

Application scope

• ECS