Return
-
Title
Error: "Further authentication required" & "Keyboard-interactive authentication prompts from server" -
Description
When attempting a session from SPP, auto login is not perform and the user is requested to enter a password. After manually entering the password login is successful:"Further authentication requiredKeyboard-interactive authentication prompts from server:
Password:"
The SPS logs show the following:YYYY-DD-MMTHH:MM:SS sps68.oneid.com zorp/scb_ssh[PID]: scb.info(4): (svc/ox1idcANxq9CvvwNHpsmqM/safeguard_default:3/ssh): Plugin(credentialstore/SGCredStore/main.py): [ERROR] Denied by password vault; code=500, data=YYYY-DD-MMTHH:MM:SS sps68.oneid.com zorp/scb_ssh[PID]: ssh.policy(4): (svc/ox1idcANxq9CvvwNHpsmqM/safeguard_default:3/ssh): Cannot load credential information for autologin; state='AUTOLOGIN_TRY_NEXT_USERAUTH_METHOD', method='publickey'YYYY-DD-MMTHH:MM:SS sps68.oneid.com zorp/scb_ssh[PID]: ssh.info(4): (svc/ox1idcANxq9CvvwNHpsmqM/safeguard_default:3/ssh): No supported methods found to use with autologin; fallback_to_relay='yes'YYYY-DD-MMTHH:MM:SS sps68.oneid.com zorp/scb_ssh[PID]: ssh.debug(6): (svc/ox1idcANxq9CvvwNHpsmqM/safeguard_default:3/ssh): Auth service transitioning to state; state='SERVER_WAIT_USERAUTH_RESP', old_state='AUTOLOGIN_TRY_NEXT_USERAUTH_METHOD' -
Cause
Keyboard-interactive authentication is not supported for sessions when using SPP. The authentication method PasswordAuthentication is not enabled on the target -
Resolution
To validate that PasswordAuthentication is enabled on the target run the command# ssh -o PreferredAuthentications="password" username@127.0.0.1
If PasswordAuthentication is disabled, it will show a permission denied error:Permission denied (gssapi-keyex,gssapi-with-mic,publickey,keyboard-interactive).
If PasswordAuthentication is enabled, it will allow the logon and prompt for the passwordusername@127.0.0.1's password:
To resolve the issue, on the target Asset, ensure PasswordAuthentication is enabled in the sshd_config, then restart SSHD
For example:[root@centos1 ~]# sshd -T | grep -i passworda
Alternatively, use SSH Key authentication instead of Password authentication.
passwordauthentication yes -
Change Request
PAM-15608