I have an AIX 7.2 server that we use as a gold image server. I was going through some CIS Benchmark settings dealing with the "Default" values and ended up losing access. Luckily I have a user with an SSH key on the box so I was able to get back in. I am having an issue trying to see what is causing my issue and was leaning towards the community for assistance.
/etc/security/login.cfg
default:
sak_enabled = false
logintimes =
logindisable = 0
logininterval = 0
loginreenable = 0
logindelay = 10
herald = "\r\n NOTICE:\r\n\r\n Access to this computer system/network and the information on it is the\r\n property of The Huntington and is intended only for employees and other\r\n users properly authorized by The Huntington. It is to be accessed only\r\n for proper business purposes in accordance with Huntington Policies,\r\n Standards and Guidelines. Unauthorized access or improper use of this\r\n system/network and the information on it will be cause for disciplinary\r\n action, up to and including termination and may be a criminal offense\r\n resulting in criminal prosecution and/or civil liability.\r\n\r\nlogin: "
*/dev/console:
* synonym = /dev/tty0
usw:
auth_type = PAM_AUTH
logintimeout = 30
maxlogins = 32767
mkhomeatlogin = true
shells = /bin/sh,/bin/bsh,/bin/csh,/bin/ksh,/bin/tsh,/bin/ksh93,/usr/bin/sh,/usr/bin/bsh,/usr/bin/csh,/usr/bin/ksh,/usr/bin/tsh,/usr/bin/ksh93,/usr/bin/rksh,/usr/bin/rksh93,/usr/sbin/uucp/uucico,/usr/sbin/sliplogin,/usr/sbin/snappd,/usr/bin/bash,/bin/hnbdefaultshell,/usr/bin/hnbdefaultshell,/uv/bin/uv
pwd_algorithm = ssha256
unix_passwd_compat = true
logindelay = 10
Not sure what other data I need to provide. Here is output in the logging with an attempt from ldap and/or local user:
LOCAL USER
(utaecegdi7200.hban.us:/)# cat /var/adm/syslog | grep ecetestuser
Sep 22 10:30:09 utaecegdi7200 auth|security:debug sshd[12452152]: debug1: userauth-request for user ecetestuser service ssh-connection method none [preauth]
Sep 22 10:30:09 utaecegdi7200 auth|security:debug sshd[12452152]: debug1: PAM: initializing for "ecetestuser"
Sep 22 10:30:09 utaecegdi7200 auth|security:debug sshd[12452152]: debug1: userauth-request for user ecetestuser service ssh-connection method keyboard-interactive [preauth]
Sep 22 10:30:09 utaecegdi7200 auth|security:debug sshd[12452152]: debug1: auth2_challenge: user=ecetestuser devs= [preauth]
Sep 22 10:30:09 utaecegdi7200 auth|security:err|error sshd[12452152]: error: PAM: Authentication failed for ecetestuser from 10.176.12.209
Sep 22 10:30:09 utaecegdi7200 auth|security:err|error sshd[12452152]: error: PAM: Authentication failed for ecetestuser from 10.176.12.209
Sep 22 10:30:09 utaecegdi7200 auth|security:info sshd[12452152]: Failed keyboard-interactive/pam for ecetestuser from 10.176.12.209 port 33027 ssh2
Sep 22 10:30:19 utaecegdi7200 auth|security:info syslog: ssh: failed login attempt for ecetestuser from 10.176.12.209
Sep 22 10:30:19 utaecegdi7200 auth|security:debug sshd[12452152]: debug1: audit event euid 0 user ecetestuser event 5 (SSH_failkbdint)
Sep 22 10:30:19 utaecegdi7200 auth|security:debug sshd[12452152]: debug1: userauth-request for user ecetestuser service ssh-connection method password [preauth]
Sep 22 10:30:19 utaecegdi7200 auth|security:debug sshd[12452152]: debug1: PAM: password authentication failed for ecetestuser: Authentication failed
Sep 22 10:30:19 utaecegdi7200 auth|security:info sshd[12452152]: Failed password for ecetestuser from 10.176.12.209 port 33027 ssh2
Sep 22 10:30:39 utaecegdi7200 auth|security:info syslog: ssh: failed login attempt for ecetestuser from 10.176.12.209
Sep 22 10:30:39 utaecegdi7200 auth|security:debug sshd[12452152]: debug1: audit event euid 0 user ecetestuser event 4 (SSH_failpasswd)
Sep 22 10:30:39 utaecegdi7200 auth|security:info sshd[12452152]: Connection closed by authenticating user ecetestuser 10.176.12.209 port 33027 [preauth]
Sep 22 10:30:39 utaecegdi7200 auth|security:debug sshd[12452152]: debug1: audit event euid 0 user ecetestuser event 12 (SSH_connabndn)
LDAP USER
Sep 22 10:22:46 utaecegdi7200 auth|security:debug sshd[12583390]: debug1: audit event euid 0 user eceunix04uttap event 0 (SSH_exceedmtrix)
Sep 22 10:22:46 utaecegdi7200 auth|security:debug sshd[12583390]: debug1: audit event euid 0 user eceunix04uttap event 12 (SSH_connabndn)
Sep 22 10:24:24 utaecegdi7200 auth|security:debug sshd[13697306]: debug1: userauth-request for user eceunix04uttap service ssh-connection method none [preauth]
Sep 22 10:24:24 utaecegdi7200 auth|security:debug sshd[13697306]: debug1: PAM: initializing for "eceunix04uttap"
Sep 22 10:24:24 utaecegdi7200 auth|security:debug sshd[13697306]: debug1: userauth-request for user eceunix04uttap service ssh-connection method keyboard-interactive [preauth]
Sep 22 10:24:24 utaecegdi7200 auth|security:debug sshd[13697306]: debug1: auth2_challenge: user=eceunix04uttap devs= [preauth]
Sep 22 10:24:24 utaecegdi7200 auth|security:err|error sshd[13697306]: error: PAM: Authentication failed for eceunix04uttap from 10.176.12.209
Sep 22 10:24:24 utaecegdi7200 auth|security:err|error sshd[13697306]: error: PAM: Authentication failed for eceunix04uttap from 10.176.12.209
Sep 22 10:24:24 utaecegdi7200 auth|security:info sshd[13697306]: Failed keyboard-interactive/pam for eceunix04uttap from 10.176.12.209 port 33005 ssh2
Sep 22 10:24:24 utaecegdi7200 auth|security:info syslog: ssh: failed login attempt for eceunix04uttap from 10.176.12.209
Sep 22 10:24:24 utaecegdi7200 auth|security:debug sshd[13697306]: debug1: audit event euid 0 user eceunix04uttap event 5 (SSH_failkbdint)
Sep 22 10:24:25 utaecegdi7200 auth|security:debug sshd[13697306]: debug1: userauth-request for user eceunix04uttap service ssh-connection method password [preauth]
Sep 22 10:24:25 utaecegdi7200 auth|security:debug sshd[13697306]: debug1: PAM: password authentication failed for eceunix04uttap: Authentication failed
Sep 22 10:24:25 utaecegdi7200 auth|security:info sshd[13697306]: Failed password for eceunix04uttap from 10.176.12.209 port 33005 ssh2
Sep 22 10:24:25 utaecegdi7200 auth|security:info syslog: ssh: failed login attempt for eceunix04uttap from 10.176.12.209
Sep 22 10:24:25 utaecegdi7200 auth|security:debug sshd[13697306]: debug1: audit event euid 0 user eceunix04uttap event 4 (SSH_failpasswd)
Sep 22 10:24:26 utaecegdi7200 auth|security:info sshd[13697306]: Connection closed by authenticating user eceunix04uttap 10.176.12.209 port 33005 [preauth]
Sep 22 10:24:26 utaecegdi7200 auth|security:debug sshd[13697306]: debug1: audit event euid 0 user eceunix04uttap event 12 (SSH_connabndn)
------------------------------
Joshua Krause
------------------------------