KB-45495: SSH prompts for a password if SELinux is set to Enforcing

Home >

KB-45495: SSH prompts for a password if SELinux is set to Enforcing

Product:

Authentication Service ,

Published:

8 December,20 at 04:22 PM

Rating:

Problem: SSH prompts for a password if SELinux is set to "enforcing". The logs shows the following error message:

error: ssh_selinux_setup_pty: security_compute_relabel: Invalid argument

Cause: The home directories on the NAS is missing the setting for ".K5login" causing SSH to prompt for a password with SELinux set to "enforicing" when it shouldn't be.

Workaround: Set SELinux to "permissive" with the command below is the workaround,

$ setenforce permissive

User-added image

Solution: First change SELinux to "permissive" ($ setenforce permissive), then run the command below to set SELinux Boolean to use NFS as home directories on the server. Now set SELinux to enforcing($ setenforce enforcing).

NOTE: To verify/query list of all the SELinux booleans for specific service run command below:

# semanage boolean -l | egrep "nfs|SELinux" (NOTE: For this example use_nfs_home_dirs is off meaning it is not SELinux Boolean is not set.)

User-added image