IBM AIX 7.2 – Common Problem 163 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Operations scripts can no longer connect via SSH key after a hardening change. Automated jobs fail and Ops resort to passwords, breaking compliance.

Environment & Reproduction

Occurs after sshd_config or directory permission changes on AIX OpenSSH.

lssrc -s sshd
oslevel -s
uname -a

Root Cause Analysis

Cause is typically loose permissions on the user home or .ssh directory, or PubkeyAuthentication disabled in /etc/ssh/sshd_config.

Quick Triage

Validate permissions, sshd configuration, and log for refusal reasons.

lssrc -s sshd

Step-by-Step Diagnosis

Capture deeper evidence to isolate the failure path.

lssrc -s sshd
grep -i pubkey /etc/ssh/sshd_config
ls -ld ~deploy ~deploy/.ssh
awk '{print}' ~deploy/.ssh/authorized_keys
errpt | head

Solution – Primary Fix

Apply the proven primary fix in a controlled change window.

chmod 700 ~deploy/.ssh
chmod 600 ~deploy/.ssh/authorized_keys
chown deploy:staff ~deploy/.ssh
chsec -f /etc/ssh/sshd_config -s default -a PubkeyAuthentication=yes
stopsrc -s sshd; startsrc -s sshd

Solution – Alternative Approaches

Use these alternatives when the primary fix is blocked by environmental constraints.

smitty user
ssh-copy-id deploy@target
chsec -f /etc/security/user -s deploy -a rlogin=true

Verification & Acceptance Criteria

Confirm the system meets acceptance criteria after the change.

ssh -vv deploy@localhost 2>&1 | head
tail /var/log/auth.log
lssrc -s sshd

Rollback Plan

Revert cleanly if regressions appear during validation.

stopsrc -s sshd
cp /etc/ssh/sshd_config.bak /etc/ssh/sshd_config
startsrc -s sshd

Prevention & Hardening

Reduce recurrence with monitoring and preventive tuning.

auditpr -t1
errnotify -a 'en_name=sshd'
chsec -f /etc/ssh/sshd_config -s default -a PermitRootLogin=no

Related Errors & Cross-Refs

Related to LDAP authentication, PAM stack changes, and SELinux-like RBAC controls.

Related tutorial: View the step-by-step tutorial for aix-7.2.

View all aix-7.2 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

IBM AIX 7.2 OpenSSH guide, sshd_config man page.