I’m finding that I cannot use ssh to the root account.
This worked until recently. It seems to be an “selinux” issue. It works again after “setenforce 0”.
Is anyone else having this problem? Has a bug been reported?
Not seeing that here…
Two different Hyprland systems and one GNOME system show;
cat /etc/os-release
NAME="openSUSE Tumbleweed"
# VERSION="20260723"
sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 35
Likewise one GNOME setup still with appamor, not root login issues.
Note one of the Hyprland systems is running account-utils and enable-no_new_privs.
I’m getting the same output from “sestatus”.
I’m seeing this problem on two systems. One was installed on Jun 18, and one was installed yesterday.
For the on installed on Jun 18, ssh to root@localhost was working until recently. On the one installed yesterday, it has never worked.
I should add that I’m using public key authentication in my attempts to ssh to root.
Investigating further:
In my “sshd_config.d”, I have:
PermitRootLogin prohibit-password
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM no
Those lines are supposed to disallow anything other than public key authentication. If I remove those lines, then the ssh works.
I’ve tried removing the “UsePAM no” line. But that doesn’t fix it.
The error that I get is
root@localhost: Permission denied (publickey).
Something is broken somewhere. Those configuration lines should not stop publickey authentication.
Run sshd in debug.
/usr/sbin/sshd -ddd
Run ssh with very verbose.
/usr/bin/ssh -vvv
You haven’t provided any logs as to what is happening. Just saying it doesn’t work and I think it should isn’t going to let anyone help you.
I’ve tried “ssh -vvv”. I’m not seeing anything relevant.
twsdboot:rickert 1% ssh -vvv root@localhost
debug1: OpenSSH_10.3p1, OpenSSL 3.5.3 16 Sep 2025
debug3: Running on Linux 7.1.3-1-default #1 SMP PREEMPT_DYNAMIC Sat Jul 4 16:20:40 UTC 2026 (1cb5006) x86_64
debug3: Started with: ssh -vvv root@localhost
debug1: Reading configuration data /home/rickert/.ssh/config
debug1: /home/rickert/.ssh/config line 1: Applying options for *
debug1: Reading configuration data /usr/etc/ssh/ssh_config
debug3: /usr/etc/ssh/ssh_config line 30: Including file /etc/ssh/ssh_config.d/01-localhost.conf depth 0
debug1: Reading configuration data /etc/ssh/ssh_config.d/01-localhost.conf
debug3: /usr/etc/ssh/ssh_config line 31: Including file /usr/etc/ssh/ssh_config.d/50-suse.conf depth 0
debug1: Reading configuration data /usr/etc/ssh/ssh_config.d/50-suse.conf
debug2: checking match for 'final all' host localhost originally localhost
debug3: /usr/etc/ssh/ssh_config.d/50-suse.conf line 3: not matched 'final'
debug2: match not found
debug3: /usr/etc/ssh/ssh_config.d/50-suse.conf line 5: Including file /etc/crypto-policies/back-ends/openssh.config depth 1 (parse only)
debug1: Reading configuration data /etc/crypto-policies/back-ends/openssh.config
debug3: gss kex names ok: [gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-]
debug1: /usr/etc/ssh/ssh_config line 33: Applying options for *
debug1: configuration requests final Match pass
debug1: re-parsing configuration
debug1: Reading configuration data /home/rickert/.ssh/config
debug1: /home/rickert/.ssh/config line 1: Applying options for *
debug1: Reading configuration data /usr/etc/ssh/ssh_config
debug3: /usr/etc/ssh/ssh_config line 30: Including file /etc/ssh/ssh_config.d/01-localhost.conf depth 0
debug1: Reading configuration data /etc/ssh/ssh_config.d/01-localhost.conf
debug3: /usr/etc/ssh/ssh_config line 31: Including file /usr/etc/ssh/ssh_config.d/50-suse.conf depth 0
debug1: Reading configuration data /usr/etc/ssh/ssh_config.d/50-suse.conf
debug2: checking match for 'final all' host localhost originally localhost
debug3: /usr/etc/ssh/ssh_config.d/50-suse.conf line 3: matched 'final'
debug2: match found
debug3: /usr/etc/ssh/ssh_config.d/50-suse.conf line 5: Including file /etc/crypto-policies/back-ends/openssh.config depth 1
debug1: Reading configuration data /etc/crypto-policies/back-ends/openssh.config
debug3: gss kex names ok: [gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-]
debug1: /usr/etc/ssh/ssh_config line 33: Applying options for *
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts' -> '/home/rickert/.ssh/known_hosts'
debug3: expanded UserKnownHostsFile '~/.ssh/known_hosts2' -> '/home/rickert/.ssh/known_hosts2'
debug2: resolving "localhost" port 22
debug3: resolve_host: lookup localhost:22
debug3: channel_clear_timeouts: clearing
debug3: ssh_connect_direct: entering
debug1: Connecting to localhost [::1] port 22.
debug3: set_sock_tos: set socket 3 IPV6_TCLASS 0x10
debug1: Connection established.
debug1: no pubkey loaded from /home/rickert/.ssh/id_rsa
debug1: identity file /home/rickert/.ssh/id_rsa type -1
debug1: no identity pubkey loaded from /home/rickert/.ssh/id_rsa
debug1: no pubkey loaded from /home/rickert/.ssh/id_ecdsa
debug1: identity file /home/rickert/.ssh/id_ecdsa type -1
debug1: no identity pubkey loaded from /home/rickert/.ssh/id_ecdsa
debug1: no pubkey loaded from /home/rickert/.ssh/id_ecdsa_sk
debug1: identity file /home/rickert/.ssh/id_ecdsa_sk type -1
debug1: no identity pubkey loaded from /home/rickert/.ssh/id_ecdsa_sk
debug1: loaded pubkey from /home/rickert/.ssh/id_ed25519: ED25519 SHA256:h/Jrby3wJAYbOToizBls6RJUH9Id7JdcqABamfX39y0
debug1: identity file /home/rickert/.ssh/id_ed25519 type 2
debug1: loaded identity pubkey from /home/rickert/.ssh/id_ed25519: ED25519-CERT SHA256:h/Jrby3wJAYbOToizBls6RJUH9Id7JdcqABamfX39y0
debug1: no pubkey loaded from /home/rickert/.ssh/id_ed25519_sk
debug1: identity file /home/rickert/.ssh/id_ed25519_sk type -1
debug1: no identity pubkey loaded from /home/rickert/.ssh/id_ed25519_sk
debug1: Local version string SSH-2.0-OpenSSH_10.3
debug1: Remote protocol version 2.0, remote software version OpenSSH_10.3
debug1: compat_banner: match: OpenSSH_10.3 pat OpenSSH* compat 0x04000000
debug2: fd 3 setting O_NONBLOCK
debug1: Authenticating to localhost:22 as 'root'
debug1: load_hostkeys: fopen /home/rickert/.ssh/known_hosts: No such file or directory
debug1: load_hostkeys: fopen /home/rickert/.ssh/known_hosts2: No such file or directory
debug3: record_hostkey: found ca key type ED25519 in file /etc/ssh/ssh_known_hosts:1
debug3: load_hostkeys_file: loaded 1 keys from localhost
debug1: load_hostkeys: fopen /etc/ssh/ssh_known_hosts2: No such file or directory
debug3: order_hostkeyalgs: prefer hostkeyalgs: ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com
debug3: send packet: type 20
debug1: SSH2_MSG_KEXINIT sent
debug3: receive packet: type 20
debug1: SSH2_MSG_KEXINIT received
debug2: local client KEXINIT proposal
debug2: KEX algorithms: sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ext-info-c,kex-strict-c-v00@openssh.com
debug2: host key algorithms: ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256
debug2: ciphers ctos: aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr
debug2: ciphers stoc: aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr
debug2: MACs ctos: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512
debug2: MACs stoc: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512
debug2: compression ctos: zlib@openssh.com,none
debug2: compression stoc: zlib@openssh.com,none
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug2: peer server KEXINIT proposal
debug2: KEX algorithms: sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ext-info-s,kex-strict-s-v00@openssh.com
debug2: host key algorithms: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com
debug2: ciphers ctos: aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr
debug2: ciphers stoc: aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr
debug2: MACs ctos: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512
debug2: MACs stoc: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512
debug2: compression ctos: none,zlib@openssh.com
debug2: compression stoc: none,zlib@openssh.com
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug3: kex_choose_conf: will use strict KEX ordering
debug1: kex: algorithm: sntrup761x25519-sha512
debug1: kex: host key algorithm: ssh-ed25519-cert-v01@openssh.com
debug1: kex: server->client cipher: aes256-gcm@openssh.com MAC: <implicit> compression: zlib@openssh.com
debug1: kex: client->server cipher: aes256-gcm@openssh.com MAC: <implicit> compression: zlib@openssh.com
debug1: kex: sntrup761x25519-sha512 need=32 dh_need=32
debug1: kex: sntrup761x25519-sha512 need=32 dh_need=32
debug3: send packet: type 30
debug1: expecting SSH2_MSG_KEX_ECDH_REPLY
debug3: receive packet: type 31
debug1: SSH2_MSG_KEX_ECDH_REPLY received
debug1: Server host certificate: ssh-ed25519-cert-v01@openssh.com SHA256:FNzrMHs8Im/IF5IEZUALj/EKTE4n8w7JeKXnah3kM7Q, serial 202607230 ID "twsdboot" CA ssh-ed25519 SHA256:V+AI/NW2PhQkL1EwvIUKmDDyXh/IkKe74gkrr5zB76o valid from 2026-07-16T16:21:54 to 2027-07-29T16:21:54
debug2: Server host certificate hostname: twsdboot
debug1: Forcing accepting of host key for loopback/localhost.
debug3: send packet: type 21
debug1: ssh_packet_send2_wrapped: resetting send seqnr 3
debug2: ssh_set_newkeys: mode 1
debug1: rekey out after 4294967296 blocks
debug1: SSH2_MSG_NEWKEYS sent
debug1: Sending SSH2_MSG_EXT_INFO
debug3: send packet: type 7
debug1: expecting SSH2_MSG_NEWKEYS
debug3: receive packet: type 21
debug1: ssh_packet_read_poll2: resetting read seqnr 3
debug1: SSH2_MSG_NEWKEYS received
debug2: ssh_set_newkeys: mode 0
debug1: rekey in after 4294967296 blocks
debug2: KEX algorithms: sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,ext-info-c,kex-strict-c-v00@openssh.com
debug2: host key algorithms: ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,webauthn-sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com,rsa-sha2-512,rsa-sha2-256
debug2: ciphers ctos: aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr
debug2: ciphers stoc: aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr
debug2: MACs ctos: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512
debug2: MACs stoc: hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512
debug2: compression ctos: zlib@openssh.com,none
debug2: compression stoc: zlib@openssh.com,none
debug2: languages ctos:
debug2: languages stoc:
debug2: first_kex_follows 0
debug2: reserved 0
debug3: send packet: type 5
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug3: kex_input_ext_info: extension server-sig-algs
debug1: kex_ext_info_client_parse: server-sig-algs=<ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512>
debug3: kex_input_ext_info: extension publickey-hostbound@openssh.com
debug1: kex_ext_info_check_ver: publickey-hostbound@openssh.com=<0>
debug3: kex_input_ext_info: extension ping@openssh.com
debug1: kex_ext_info_check_ver: ping@openssh.com=<0>
debug3: kex_input_ext_info: extension agent-forward
debug1: kex_ext_info_check_ver: agent-forward=<0>
debug3: receive packet: type 6
debug2: service_accept: ssh-userauth
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug3: send packet: type 50
debug3: receive packet: type 7
debug1: SSH2_MSG_EXT_INFO received
debug3: kex_input_ext_info: extension server-sig-algs
debug1: kex_ext_info_client_parse: server-sig-algs=<ecdsa-sha2-nistp256,sk-ecdsa-sha2-nistp256@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,sk-ssh-ed25519@openssh.com,rsa-sha2-256,rsa-sha2-512>
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug3: start over, passed a different list publickey
debug3: preferred publickey,keyboard-interactive,password
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug3: ssh_get_authentication_socket_path: path '/home/rickert/.ssh/agent/s.ZpudOkF6HN.agent.LFtPZAyzVD'
debug1: get_agent_identities: bound agent to hostkey
debug1: get_agent_identities: agent returned 2 keys
debug1: Will attempt key: /home/rickert/.ssh/id_ed25519 ED25519 SHA256:h/Jrby3wJAYbOToizBls6RJUH9Id7JdcqABamfX39y0 agent
debug1: Will attempt key: /home/rickert/.ssh/id_ed25519 ED25519-CERT SHA256:h/Jrby3wJAYbOToizBls6RJUH9Id7JdcqABamfX39y0 agent
debug1: Will attempt key: /home/rickert/.ssh/id_rsa
debug1: Will attempt key: /home/rickert/.ssh/id_ecdsa
debug1: Will attempt key: /home/rickert/.ssh/id_ecdsa_sk
debug1: Will attempt key: /home/rickert/.ssh/id_ed25519_sk
debug2: pubkey_prepare: done
debug1: Offering public key: /home/rickert/.ssh/id_ed25519 ED25519 SHA256:h/Jrby3wJAYbOToizBls6RJUH9Id7JdcqABamfX39y0 agent
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug1: Offering public key: /home/rickert/.ssh/id_ed25519 ED25519-CERT SHA256:h/Jrby3wJAYbOToizBls6RJUH9Id7JdcqABamfX39y0 agent
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 51
debug1: Authentications that can continue: publickey
debug1: Trying private key: /home/rickert/.ssh/id_rsa
debug3: no such identity: /home/rickert/.ssh/id_rsa: No such file or directory
debug1: Trying private key: /home/rickert/.ssh/id_ecdsa
debug3: no such identity: /home/rickert/.ssh/id_ecdsa: No such file or directory
debug1: Trying private key: /home/rickert/.ssh/id_ecdsa_sk
debug3: no such identity: /home/rickert/.ssh/id_ecdsa_sk: No such file or directory
debug1: Trying private key: /home/rickert/.ssh/id_ed25519_sk
debug3: no such identity: /home/rickert/.ssh/id_ed25519_sk: No such file or directory
debug2: we did not send a packet, disable method
debug1: No more authentication methods to try.
root@localhost: Permission denied (publickey).
twsdboot:rickert 2%
If it’s going to take pulling teeth to get what was asked, you’re not going to get anywhere.
I configured my localhost as above in a drop in /etc/ssh/sshd_config.d/01-ssh.conf restarted sshd;
ssh -vvv root@localhost
debug1: OpenSSH_10.3p1, OpenSSL 3.5.3 16 Sep 2025
debug3: Running on Linux 7.1.4-1-default #1 SMP PREEMPT_DYNAMIC Mon Jul 20 04:38:42 UTC 2026 (46107bf) x86_64
debug3: Started with: ssh -vvv root@localhost
.....
.....
debug1: Next authentication method: publickey
debug3: ssh_get_authentication_socket_path: path '/run/user/1000/gcr/ssh'
debug1: get_agent_identities: bound agent to hostkey
debug1: get_agent_identities: agent returned 2 keys
debug1: Will attempt key: /home/username/.ssh/id_ed25519 ED25519 SHA256:.......U agent
debug1: Will attempt key: username@opensuse.org ED25519 ...... agent
debug1: Will attempt key: /home/username/.ssh/id_rsa
debug1: Will attempt key: /home/username/.ssh/id_ecdsa
debug1: Will attempt key: /home/username/.ssh/id_ecdsa_sk
debug1: Will attempt key: /home/username/.ssh/id_ed25519_sk
debug2: pubkey_prepare: done
debug1: Offering public key: /home/username/.ssh/id_ed25519 ED25519 SHA256:.... agent
debug3: send packet: type 50
debug2: we sent a publickey packet, wait for reply
debug3: receive packet: type 60
debug1: Server accepts key: /home/username/.ssh/id_ed25519 ED25519 SHA256:..... agent
debug3: sign_and_send_pubkey: using publickey-hostbound-v00@openssh.com with ED25519 SHA256:............
debug3: sign_and_send_pubkey: signing using ssh-ed25519 SHA256:.........
....
....
debug2: channel_input_open_confirmation: channel 0: callback done
debug2: channel 0: open confirm rwindow 0 rmax 32768
debug3: receive packet: type 99
debug2: channel_input_status_confirm: type 99 id 0
debug2: PTY allocation request accepted on channel 0
debug2: channel 0: rcvd adjust 2097152
debug3: receive packet: type 99
debug2: channel_input_status_confirm: type 99 id 0
debug2: shell request accepted on channel 0
hostname:~ #
Your not running the latest kernel 7.1.4? The above on apparmor
OK, it’s the UsePAM entry… reproduced on a SELinux system…
I tried running “sshd -ddd”.
Then I tried the ssh login to root@localhost.
I’m doing this in a virtual machine. And it seems to have frozen. When I move the mouse pointer to the virtual machine window, the mouse pointer disappears. I guess I will need to do a forced reset to get back into it.
@nrickert The default is UsePAM no so maybe the second iteration is an issue, I see no SELinux issues.
The openSUSE default is “UsePAM yes”. See “/etc/ssh/sshd_config”.
You mean /usr/etc/ssh/sshd_config
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and KbdInteractiveAuthentication to 'no'.
UsePAM yes
Okay. Thanks.
Hmm, I thought I had tested that. Perhaps I forgot to restart sshd after removing that line. I’ve now tested again, and yes it work with that line removed.
I can live with that.
Oops, yes.
I’d add this as well then? KbdInteractiveAuthentication no
Okay, done.
I was using ChallengeResponseAuthentication no, but apparently the preferred version is the one that you suggested.
This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.