authentication failure using SSH pam_unix(sshd:auth): authentication failure;

2011-10-24T11:22:22.125623+07:00 fazries.com sshd[8909]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=sshK ruser= rhost=10.10.10.115  user=fazries
2011-10-24T11:22:22.151540+07:00 fazries.com sshd[8909]: Accepted password for fazries from 10.62.41.115 port 49633 ssh2
2011-10-24T11:22:22.263304+07:00 fazries.com sshd[8909]: pam_unix(sshd:session): session opened for user fazries by (uid=0)

when I try connect to another server using ssh, I found an error on /var/log/secure "pam_unix(sshd:auth): authentication failure; "
okay, we know the problem is on the pam module, so we should look at sshd module on pam directory at /etc/pam.d/

at /etc/pam.d/sshd

auth       include      system-auth

account    required     pam_nologin.so
account    include      system-auth

password   include     system-auth

session    required     pam_selinux.so close
session    include      system-auth
session    required     pam_loginuid.so require_auditd

here we can see the authentication included system-auth "auth include system-auth". okay next we should take a look on /etc/pam.d/system-auth on pam system-auth look at auth section, at my system-auth module, the system will check local system (pam_unix) at the first time then check the ldap database (pam_ldap).

Alhamdulillah that issue because sshd:auth want to connect to remote server and cannot find the user at local system (pam_unix), that's why appears message authentication failure,

because my user at ldap database after cannot find the user on local system then sshd:auth try to find it at ldap database (pam_ldap), and found it.

"Accepted password for fazries from 10.10.10.115 port 49633 ssh2"

at /etc/pam.d/system-auth

auth        required      pam_env.so
auth        sufficient    pam_unix.so nullok try_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        sufficient    pam_ldap.so use_first_pass
auth        required      pam_deny.so

this is the way out.... :-)

replace try_first_pass to pam.ldap.so and use_first_pass to pam_unix.so that will make ssh search user from ldap database first,if not found then ssh will search at local system.

auth        required      pam_env.so
auth        sufficient    pam_ldap.so try_first_pass
auth        sufficient    pam_unix.so nullok use_first_pass
auth        requisite     pam_succeed_if.so uid >= 500 quiet
auth        required      pam_deny.so

that will make the error message "sshd[8909]: pam_unix(sshd:auth): authentication failure;" gone.

2011-10-27T13:33:16.738779+07:00 fazries.com sshd[16689]: Accepted password for fazries from 10.62.41.115 port 41924 ssh2
2011-10-27T13:33:16.895793+07:00 fazries.com sshd[16689]: pam_unix(sshd:session): session opened for user fazries by (uid=0)