CentOS Stream 10 – Common Problem 063 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Interactive users cannot SSH in despite valid credentials after a security update.

Environment & Reproduction

Triggered when a CIS hardening profile or update sets PasswordAuthentication no.

Root Cause Analysis

Updated sshd_config disables password auth and only keys are accepted.

Quick Triage

Inspect effective config with `sshd -T | grep -i password`.

Step-by-Step Diagnosis

Confirm whether the change came from a drop-in file in /etc/ssh/sshd_config.d.

Solution – Primary Fix

Re-enable PasswordAuthentication temporarily in a drop-in and reload sshd if policy allows.

Solution – Alternative Approaches

Provision SSH keys for affected users instead of restoring password auth.

Verification & Acceptance Criteria

Authorized users log in successfully without policy violations.

Rollback Plan

Remove the drop-in file to revert to hardened policy once keys are deployed.

Prevention & Hardening

Adopt key-based auth and SSO via SSSD to remove password dependency.

Related Errors & Cross-Refs

Linked to FIPS mode constraints and PAM policy changes.

Related tutorial: View the step-by-step tutorial for centos-stream-10.

View all centos-stream-10 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

OpenSSH and CIS benchmark documentation.