Search code examples
ubuntusshpamsshdpam-unix

pam_unix.so Prints "authentication failure" on Successful Login

/var/log/messages shows a message like

Jul  6 13:00:05 orbit-32 sshd[11517]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.98.106  user=admin

although my password authentication suceeds and I am logged in. I am using PAM with pam_unix.so as the only plugin. How can this be?

Solution

  • If you enable audit logging in pam_unix and allow debug logging using syslog.conf you will see the following:

     debug2: input_userauth_request: try method none [preauth]
 ...
 pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.168.98.106  user=admin

    Login method 'none' turns out to be sshd trying to login with an empty password. This is apparently a part of the PAM specification, see http://www.gossamer-threads.com/lists/openssh/users/43558 for details.

    To fix it, set PermitEmptyPasswords to 'no' in in sshd_config. This will prevent sshd from trying an empty password against PAM.