Ubuntu 16.04 LTS SSH Authentication Fails After Hardening

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Administrators are locked out over SSH, increasing incident response time and outage risk.

Environment & Reproduction

Triggered after changing sshd_config authentication methods and PAM integration on Ubuntu 16.04.

Root Cause Analysis

Mutually incompatible authentication directives prevent valid keys or passwords from being accepted.

Quick Triage

Use console access to validate sshd syntax and check recent auth log entries.

Step-by-Step Diagnosis

Run sshd -T, inspect /var/log/auth.log, and verify key permissions and PAM module behavior.

Solution – Primary Fix

Reconcile sshd authentication directives, correct key ownership, reload service, and test staged login paths.

Solution – Alternative Approaches

Keep emergency console account access and enforce hardened templates via configuration management.

Verification & Acceptance Criteria

Authorized users can log in by approved methods and unauthorized methods are consistently rejected.

Rollback Plan

Restore previous sshd_config from backup and restart ssh service if access remains unstable.

Prevention & Hardening

Use staged sshd configuration tests and peer review for all authentication policy changes.

Related Errors & Cross-Refs

Compare with key-permission failures, disabled PAM stacks, and fail2ban lockout incidents.

Related tutorial: View the step-by-step tutorial for Ubuntu 16.04 LTS.

View all Ubuntu 16.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Refer to OpenSSH server hardening guides and Ubuntu authentication best practices.