In RHEL8.8, login fails with this entry in /etc/security/access.conf "+:username:localhost server1.example.com"

Solution Verified - Updated -

Environment

  • Red Hat Enterprise Linux 8.8
  • Red Hat Enterprise Linux 9
  • pam_access.so

Issue

  • Using "with-pamaccess" feature with authselect, login with localhost and hostname fails with the below entry in /etc/security/access.conf
+:username:localhost server1.example.com

Resolution

  • As a workaround modify the entry in /etc/security/access.conf for the required user, as below:
+:username:127.0.0.1 ::1 x.x.x.x

Replace x.x.x.x with the actual value of IP address.

  • As per the fix provided in the bug, update the package for pam to pam-1.3.1-32.el8 .

Root Cause

Diagnostic Steps

  • /etc/security/access.conf file is configured for the user test21, as below:
[root@rhds12 ~]# cat  /etc/security/access.conf  | grep -v -e "^#" | grep test21
+:test21:localhost
  • Tried to login :
[root@rhds12 ~]# ssh test21@localhost
test21@localhost's password: 
Connection closed by ::1 port 22
  • Now, replaced localhost with 127.0.0.1
[root@rhds12 ~]# cat  /etc/security/access.conf  | grep -v -e "^#" | grep test21
+:test21:127.0.0.1
  • But still failed to login with localhost:
[root@rhds12 ~]# ssh test21@localhost
test21@localhost's password: 
Connection closed by ::1 port 22
  • Now added ::1 (i.e IPv6 loopback) in /etc/security/access.conf:
[root@rhds12 ~]# cat  /etc/security/access.conf  | grep -v -e "^#" | grep test21
+:test21:127.0.0.1 ::1
  • Tried to login and it worked fine:
[root@rhds12 ~]# ssh test21@localhost
test21@localhost's password: 

There were 3 failed login attempts since the last successful login.
[test21@rhds12 ~]$
  • Now added hostname of the machine, so that it can be accessed with hostname:
[root@rhds12 ~]# cat  /etc/security/access.conf  | grep -v -e "^#" | grep test21
+:test21:127.0.0.1 ::1 rhds12.example.com
  • But login failed:
[root@rhds12 ~]# ssh test21@rhds12.example.com
test21@rhds12.example.com's password: 
Connection closed by x.x.x.x port 22
  • Now added IP-address instead of hostname:
[root@rhds12 ~]# cat  /etc/security/access.conf  | grep -v -e "^#" | grep test21
+:test21:127.0.0.1 ::1 x.x.x.x
  • Tried to login and it worked fine when logged in with hostname:
[root@rhds12 ~]# ssh test21@rhds12.example.com
test21@rhds12.example.com's password: 

There were 2 failed login attempts since the last successful login.
Last login: Thu Aug  3 12:20:06 2023 from ::1
[test21@rhds12 ~]$

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments