Can't ssh into fedora container (lxc): redux

[Mike Wright]

Hi all,

Now that sshd is working as a service I tried to ssh in and got bounced 
out.  Trying again with ssh -v FED ( container's name ) yields:

debug1: Server accepts key: /home/mike/...

journalctl -xeu sshd shows:

FED unix_chkpwd[881]: could not obtain user info (mike)
FED sshd[735]: fatal: Access denied for user mike by PAM account 
configuration [preauth]

( mike exists and has a password )

I've never run into this before.  If I remember correctly this didn't 
happen with f38.  I skipped f39.  I've since destroyed f38 and can't 
recreate it to verify ( did it term out and is no longer in the 
repository? )

Some searches have said a user must attempt to login a first time before 
they are "setup" in the system ( is that the [preauth] ? ).  Since the 
containers are headless that isn't possible.

I tried attaching to the container ( as root ) and using sudo to become 
mike but that asks for a password which also fails and I get the same 
journalctl errors "fatal: Access denied..."

Does anybody know of another way to validate new accounts?

Thanks,
Mike Wright

[Jeffrey Walton]

On Sun, Aug 25, 2024 at 11:30 PM Mike Wright
 wrote:
> Now that sshd is working as a service I tried to ssh in and got bounced
> out.  Trying again with ssh -v FED ( container's name ) yields:
>
> debug1: Server accepts key: /home/mike/...
>
> journalctl -xeu sshd shows:
>
> FED unix_chkpwd[881]: could not obtain user info (mike)
> FED sshd[735]: fatal: Access denied for user mike by PAM account
> configuration [preauth]
>
> ( mike exists and has a password )
>
> I've never run into this before.  If I remember correctly this didn't
> happen with f38.  I skipped f39.  I've since destroyed f38 and can't
> recreate it to verify ( did it term out and is no longer in the
> repository? )
>
> Some searches have said a user must attempt to login a first time before
> they are "setup" in the system ( is that the [preauth] ? ).  Since the
> containers are headless that isn't possible.
>
> I tried attaching to the container ( as root ) and using sudo to become
> mike but that asks for a password which also fails and I get the same
> journalctl errors "fatal: Access denied..."
>
> Does anybody know of another way to validate new accounts?

Missing relevant details, like PAM configuration and the guest
system's user accounts. You will only receive speculative answers.

Two interesting fixes here: https://serverfault.com/q/540004. I'm
not sure if either apply.

Jeff