CentOS Stream 9 – Common Problem 039 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

After editing /etc/pam.d/system-auth no user can log in via SSH.

Environment & Reproduction

Hosts where PAM stack was hand-edited without authconfig/authselect.

cat /etc/os-release
uname -r
rpm -qa | grep 

Root Cause Analysis

Broken include line or duplicate auth required line.

Quick Triage

Confirm package, network, SELinux and firewall state.

authselect current
grep -n include /etc/pam.d/system-auth

Step-by-Step Diagnosis

Drill into auth/pam state and recent journal entries to isolate the failure.

journalctl -u sshd -n 50
authselect check

Solution – Primary Fix

Apply the standard remediation for auth/pam on CentOS Stream 9.

sudo authselect select sssd with-mkhomedir --force
sudo systemctl restart sshd

Solution – Alternative Approaches

Boot to single user mode and reset PAM via authselect.

Verification & Acceptance Criteria

Validate the fix with positive functional checks before closing.

ssh test-user@localhost
authselect current

Rollback Plan

Revert to the previous known-good configuration if the fix regresses.

cp /root/backup/system-auth /etc/pam.d/system-auth

Prevention & Hardening

Codify the fix in configuration management and add monitoring.

Manage PAM stack via authselect profiles only.

Related Errors & Cross-Refs

Lockout after MFA misconfig.

Related tutorial: View the step-by-step tutorial for centos-stream-9.

View all centos-stream-9 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

authselect(8) documentation.