DocsICP FilingConsole
Documentation

Cannot log on to a Linux ECS instance with the correct password

Updated at:
Copy as MD
Product
My Favorites
Note

This document may contain information about third-party products. This information is for reference only. Alibaba Cloud makes no warranties, express or implied, about the performance and reliability of third-party products. Alibaba Cloud is not responsible for any potential impact that may arise from operations that involve these products.

Problem description

When you connect to a Linux Elastic Compute Service (ECS) instance using the Secure Shell Protocol (SSH), you cannot log on even if you enter the correct password. When this issue occurs, you might be unable to log on using either the management terminal or an SSH client. The secure log contains error messages similar to the following.

  • sshd[1199]: pam_listfile(sshd:auth): Refused user root for service sshd

  • sshd[1199]: Failed password for root from 192.X.X.1 port 22 ssh2

  • sshd[1204]: Connection closed by 192.X.X.2

Cause

The logon fails because of an access control policy related to the Pluggable Authentication Modules (PAM) module (pam_listfile.so).

Solution

Note

  • Before you perform risky operations, such as modifying an instance or its data, assess the disaster recovery and fault tolerance of the instance to ensure data security.

  • Before you modify the configurations or data of instances, such as ECS and RDS instances, create snapshots or enable features such as RDS log backup.

  • If you have granted permissions or submitted security information, such as logon credentials, on the Alibaba Cloud platform, change them promptly.

The following steps describe how to resolve the issue by checking the configurations of the PAM module, which is used for access control in Linux. The Linux configurations and instructions in this topic are based on the CentOS 6.5 64-bit operating system. The configurations may vary for other operating system versions. For more information, see the official documentation for your operating system.

  1. Log on to the instance and use a command such as cat to view the corresponding PAM configuration file. The configuration files are described as follows.

    File

    Description

    /etc/pam.d/login

    Configuration file for the console (management terminal)

    /etc/pam.d/sshd

    Configuration file for SSH logon

    /etc/pam.d/system-auth

    Global system configuration file

    Confirm that a configuration similar to the following exists. 

    auth required pam_listfile.so item=user sense=allow file=/etc/ssh/whitelist onerr=fail

  2. These policies can improve server security. Determine whether to modify the configuration based on a balance of security and usability. Before you modify the configuration, back up the file. The policy parameters are described as follows.

    • item: Sets the object type for access control. Valid values include tty, user, rhost, ruser, group, and shell.

    • sense: Specifies the control method for items that match the criteria in the configuration file. Valid values are `allow` and `deny`. `allow` indicates a whitelist. `deny` indicates a blacklist.

    • file: Specifies the full path of the configuration file.

    • onerr: Defines the default return value when an error occurs, such as being unable to open the configuration file.

  3. Use an editor such as `vi` to delete the policy configuration. You can also comment out the policy configuration by adding a number sign (#) at the beginning of the line, as shown below. 

    #auth required pam_listfile.so item=user sense=allow file=/etc/ssh/whitelist onerr=fail

  4. Log on to the server again to confirm that the issue is resolved.

More information

  • Pluggable Authentication Modules (PAM) is an authentication mechanism from Sun Microsystems. It uses dynamic-link libraries and a standard set of APIs to separate services from their authentication methods. This separation lets system administrators configure different authentication methods for different services without changing the service programs. It also simplifies adding new authentication methods to the system.

  • Each application that uses the PAM module has a corresponding configuration file in the /etc/pam.d folder. For example, the configuration file for the `login` command is /etc/pam.d/login. Specific policies are configured in these files.

  • For more information about pam_listfile, see pam_listfile.

  • If the issue persists, see Troubleshooting guide for failing to remotely log on to a Linux instance using SSH for further analysis.

Applicable to

  • Elastic Compute Service