Centrify

Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >
article

KB-11458: SSH Logins Fail After Migrating to Centrify OpenSSH

Authentication Service ,  

19 March,19 at 09:01 PM

Problem: While migrating from stock openssh to Centrify openssh, ssh logins fail after uninstalling stock openssh. 

Cause: When removing stock openssh with the command yum remove openssh the package is uninstalled along with its dependencies. But the pam stack is also changed and the sshd file is removed. 

ls /etc/pam.d can be executed to confirm the missing sshd file is the issue. 

In /var/log/centrifydc.log the following error might be found as well. 

Dec 30 10:25:57 machine001 adclient[71805]: INFO  AUDIT_TRAIL|Centrify Suite|Centrify sshd|1.0|105|SSHD denied|5|user=dwirth(type:ad,dwirth@ocean.net) pid=73230 utc=1544557197956 centrifyEventID=27105 DASessID=N/A DAInst=N/A status=DENIED service=ssh-connection tty=(no tty) authMechanism=keyboard-interactive client=xxx.xxx.xxx.xxx reason=AUTH_FAIL_KBDINT(failed in keyboard interactive authentication.) MfaRequired=false EntityName=ocean.net\\machine001

Workaround:
1)Do not uninstall stock openssh, it is disabled after the installation of Centrify OpenSSH is complete. 
2)Take a backup of the /etc/pam.d/sshd before uninstalling stock openssh and restore it afterwards. 
 

Related Articles

 articleKB-7555: Unable to login as root after upgrade to Centrify Suite 2016 (CDC 5.3.0) articleKB-20210: Common Questions Regarding Centrify DirectControl and CoreOS articleKB-6041: How to show current license type in use by adclient articleKB-6040: How to change the license type in use after adclient successful joined to the AD? article[How To] Enable Symantec VIP MFA for Centrify Server Suite on Linux Part III articleKB-6073: How to join the Linux/Unix Centrify Server to Active Directory with specific Computer Role? article[How To] Enable Symantec VIP MFA for Centrify Server Suite on Linux Part I articleKB-8942: What are the steps to migrate a RHEL Brightstore cluster to Centrify articleKB-6056: How to report the group policy settings that are in effect for the local computer?