-
Title
"KRB5KDC_ERR_PREAUTH_FAILED" error received in system logs only when logging in using ssh -
Description
"KRB5KDC_ERR_PREAUTH_FAILED" error received in system logs only when logging in using ssh
Logon fails for a user when using ssh.
The system log shows the "KRB5KDC_ERR_PREAUTH_FAILED" error message.
For example from /var/log/secure on Linux:
------------------------------------------
Mar 21 12:12:35 server1 sshd[13926]: pam_vas: Authentication <failed> for <Active Directory> user: <user1> account: <EXAMPLE\user1> service: <sshd> reason: <VAS_ERR_KRB5: Kerberos error Failed to obtain credentials. Client: user1@EXAMPLE.COM, Service: krbtgt/EXAMPLE.COM@EXAMPLE.COM, Server: server1.example.com Caused by: KRB5KDC_ERR_PREAUTH_FAILED (-1765328360): Preauthentication failed>Mar 21 12:12:35 server1 sshd[13916]: error: PAM: Authentication failure for illegal user user1 from server2.example.com
Mar 21 12:12:35 server1 sshd[13916]: Failed keyboard-interactive/pam for invalid user user1 from 10.x.x.x port 60171 ssh2
-----------------------
Notice the 'illegal user' part in the second message and the 'invalid user' in the third message. -
Cause
Possible sshd configuration issue. -
Resolution
Check the sshd_config file on the server to determine if an 'AllowUsers' entry exists.
cat /etc/ssh/sshd_config | grep AllowUsers
If the entry does exist, then ensure that the user is included in the entry.
If a AllowUsers line exists then it will only allow the listed users to logon.
sshd will not forward the password to Authentication services for any other users.