ssh login giving Access denied

[Devesh Pant_1]

Hello admins,

I have a Red Hat Linux 3 server that I am not able to log on using my id
I am getting something like this
dpser12@swswdev503's password:
Access denied

I have reset my password as root still doesn't work
I have also tried the usermod -U dpser12
Where should I look ?
thanks
DP

[Ivan Ferreira]

Check the /var/log/auth and /var/log/messages.

Run ssh -v dpser12@swswdev503 and post the output.

In the server, stop the SSH service and start it in foreground mode to check the messages:

service sshd stop
/usr/sbin/sshd -d

Check the user's shell and home directory permissions.

[Ivan Ferreira]

Also, check your /etc/ssh/sshd_config file if you have the AllowUsers/DenyUsers or AllowGroup s/DenyGroups directive configured.

[Devesh Pant_1]

Thanks for the early response
There is no /var/log/auth file
Here are the last 2 lines from the /var/log/messages

Aug 4 17:33:42 swswdev503 pam_tally[31348]: user dpser12 (1241) tally 20, deny 5
Aug 4 17:34:20 swswdev503 pam_tally[31428]: user dpser12 (1241) tally 21, deny 5
and here is the
# ssh -v dpser12@swswdev503

OpenSSH_3.8, OpenSSL 0.9.7d 17 Mar 2004
HP-UX_Secure_Shell-A.03.81.002, HP_UX Secure Shell version
debug1: Reading configuration data /opt/ssh/etc/ssh_config
debug1: Connecting to swswdev503 [10.129.66.92] port 22.
debug1: Connection established.
debug1: identity file /.ssh/id_rsa type -1
debug1: identity file /.ssh/id_dsa type 2
debug1: Remote protocol version 2.0, remote software version OpenSSH_3.6.1p2
debug1: match: OpenSSH_3.6.1p2 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_3.8
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-cbc hmac-md5 none
debug1: kex: client->server aes128-cbc hmac-md5 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<1024<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host 'swswdev503' is known and matches the RSA host key.
debug1: Found key in /.ssh/known_hosts:23
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
Authorized use only. All activity may be logged.

debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Trying private key: /.ssh/id_rsa
debug1: Offering public key: /.ssh/id_dsa
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: keyboard-interactive
debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: password
dpser12@swswdev503s password:
debug1: Authentications that can continue: publickey,password,keyboard-interactive
Permission denied, please try again.

User's shell is /bin/bash and home directory is
drwx------ 3 dpser12 dpser12 4096 Apr 28 23:20 dpser12

I am able to su - dpser12 as root

[Ivan Ferreira · Accepted solution]

You have configured maximum logins attemps and account locking

pam_tally[31428]: user dpser12 (1241) tally 21,


Try with:

pam_tally --user dpser12 --reset=0

The sintax is:

pam_tally [--file rooted-filename] [--user username] [--reset[=n]]

[Devesh Pant_1]

Thanks a lot Ivan

Someone here suggested using the command
pam_tally --user (username) --reset=0

and it did the trick, although no one here could give me an explanation. I will keep looking and gaining more knowledge on pam I think. Any ideas where should I look for pam ?

thanks
Devesh

[Devesh Pant_1]

Thanks a lot Ivan

Someone here suggested using the command
pam_tally --user (username) --reset=0

and it did the trick, although no one here could give me an explanation. I will keep looking and gaining more knowledge on pam I think. Any ideas where should I look for pam ?

thanks
DP

[Ivan Ferreira]

Normally it's configured in /etc/pam.d/system-auth.

It's used for lock an account after N bad logon attemps.

See:

http://darwingrok.physics.ox.ac.uk:8080/source/xref/pam/pam/modules/pam_tally/