Resolute verification, fresh container [comment 1/2]:
BEFORE UPDATE
root@ephemeral-resolute-703:~# apt-cache policy openssh-server
openssh-server:
Installed: 1:10.2p1-2ubuntu3.2
Candidate: 1:10.2p1-2ubuntu3.2
Version table:
*** 1:10.2p1-2ubuntu3.2 500
500 http://archive.ubuntu.com/ubuntu resolute-updates/main amd64
Packages
500 http://security.ubuntu.com/ubuntu resolute-security/main amd64
Packages
100 /var/lib/dpkg/status
1:10.2p1-2ubuntu3 500
500 http://archive.ubuntu.com/ubuntu resolute/main amd64 Packages
root@ephemeral-resolute-703:~# sh repro.sh
[omitting output of the installation step for brevity...]
==> Ensuring local test account 'testdev'
[sss_cache] [sss_tool_confdb_init] (0x0010): Can't access
'/var/lib/sss/db/config.ldb', probably SSSD isn't configured
Can't find configuration db, was SSSD configured and run?
[sss_cache] [sss_tool_confdb_init] (0x0010): Can't access
'/var/lib/sss/db/config.ldb', probably SSSD isn't configured
Can't find configuration db, was SSSD configured and run?
BAD PASSWORD: The password is shorter than 8 characters
[sss_cache] [sss_tool_confdb_init] (0x0010): Can't access
'/var/lib/sss/db/config.ldb', probably SSSD isn't configured
Can't find configuration db, was SSSD configured and run?
Password for 'testdev' is: testpw
==> Configuring /etc/nsswitch.conf
passwd: sss files
group: sss files
shadow: files
==> Configuring sshd + PAM
==> Writing /etc/sssd/sssd.conf
==> Starting services (sssd, ssh) via systemd
==> Waiting for SSSD to canonicalize 'testdev' -> 'testdev@proxytest'
OK: getent passwd testdev@proxytest ->
testdev@proxytest:x:1001:1001::/home/testdev:/bin/bash
Canonical pw_name short 'testdev': testdev@proxytest
==> Attempting verification login: ssh testdev@localhost
ssh client output:
Warning: Permanently added 'localhost' (ED25519) to the list of known hosts.
Connection closed by 127.0.0.1 port 22
==> sshd journal evidence (since 2026-07-09 12:40:12)
Jul 09 12:40:14 ephemeral-resolute-703 sshd-session[2682]: debug1: PAM user
"testdev" does not match expected "testdev@proxytest"
Jul 09 12:40:14 ephemeral-resolute-703 sshd-session[2682]: debug1: PAM:
cleanup
Jul 09 12:40:14 ephemeral-resolute-703 sshd-session[2682]: debug1: PAM:
initializing for "testdev" with service "sshd"
Jul 09 12:40:14 ephemeral-resolute-703 sshd-session[2682]: debug1: PAM:
setting PAM_RHOST to "127.0.0.1"
Jul 09 12:40:14 ephemeral-resolute-703 sshd-session[2682]: debug1: PAM:
setting PAM_TTY to "ssh"
Jul 09 12:40:14 ephemeral-resolute-703 sshd-session[2682]: debug1:
auth2_challenge_start: trying authentication method 'pam' [preauth]
Jul 09 12:40:14 ephemeral-resolute-703 sshd-session[2682]: debug1:
kbdint_alloc: devices 'pam' [preauth]
Jul 09 12:40:14 ephemeral-resolute-703 sshd-session[2682]: fatal: PAM user
mismatch
Jul 09 12:40:14 ephemeral-resolute-703 sshd[2680]: srclimit_penalise: ipv4:
new 127.0.0.1/32 deferred penalty of 1 seconds for penalty: connections without
attempting authentication
==> VERDICT
openssh-server version : 1:10.2p1-2ubuntu3.2
ssh login outcome : rejected
mismatch journal line : Jul 09 12:40:14 ephemeral-resolute-703
sshd-session[2682]: debug1: PAM user "testdev" does not match expected
"testdev@proxytest"
RESULT: BUG REPRODUCED.
Login was rejected and sshd logged the PAM consistency-check failure:
Jul 09 12:40:14 ephemeral-resolute-703 sshd-session[2682]: debug1: PAM
user "testdev" does not match expected "testdev@proxytest"
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2151817
Title:
SSSD incompatible with OpenSSH ≥10.1p1 PAM username consistency check
when using short names
To manage notifications about this bug go to:
https://bugs.launchpad.net/sssd/+bug/2151817/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
