How to fix shell request failed on channel 0 in SSH

# Non-interactive: bypasses the login shell startup path
ssh user@hostname echo ok

# Interactive: this is what fails with "shell request failed on channel 0"
ssh user@hostname

# What shell is assigned to the user?
getent passwd "$USER"
# e.g. user:x:1000:1000::/home/user:/bin/bash  <- last field is the shell

# Does the shell binary exist and is it executable?
ls -l /bin/bash
file /bin/bash

# Is it a valid login shell?
cat /etc/shells

sudo usermod -s /bin/bash username
# Add the shell to /etc/shells if it is missing
grep -qxF /bin/bash /etc/shells || echo /bin/bash | sudo tee -a /etc/shells

# Confirm the home directory exists and is owned by the user
getent passwd "$USER" | cut -d: -f6   # shows the home path
ls -ld /home/username

# It should be owned by the user and not world-writable, e.g.:
# drwxr-xr-x 5 username username ... /home/username

sudo chown -R username:username /home/username
sudo chmod 755 /home/username
# If the home directory is missing, create and populate it:
sudo mkhomedir_helper username   # Debian/Ubuntu (pam_mkhomedir)

# Look for any filesystem at or near 100% (especially / and /home)
df -h

# Is the root filesystem read-only? "ro" instead of "rw" indicates a problem.
mount | grep ' / '
# Check /home too if it is a separate mount
mount | grep ' /home '

sudo dmesg | tail -30
sudo mount -o remount,rw /

# In /etc/ssh/sshd_config, set:
#   LogLevel DEBUG3
sudo sshd -t                      # validate config first
sudo systemctl restart sshd       # or: sudo systemctl restart ssh

# Watch the auth log (Debian/Ubuntu) ...
sudo tail -f /var/log/auth.log
# ... or via journald (RHEL/Fedora/systemd):
sudo journalctl -u sshd -f        # use ssh.service on Debian/Ubuntu

# Look for PAM failures in the auth log / journal around your login time
sudo grep -i pam /var/log/auth.log | tail -20
sudo journalctl -u sshd --since '5 min ago'

# As the affected user (or root acting on their behalf), back up shell rc files
mv ~/.bashrc ~/.bashrc.bak 2>/dev/null
mv ~/.profile ~/.profile.bak 2>/dev/null

# SELinux: check current mode and search for denials tied to ssh/login
getenforce
sudo ausearch -m avc -ts recent | grep -Ei 'ssh|shell|home' 

# AppArmor: list active profiles and check the system log for DENIED lines
sudo aa-status
sudo journalctl -k | grep -i apparmor | tail -20

sudo setenforce 0   # TEMPORARY diagnostic — does not survive reboot
# test the login, then immediately revert:
sudo setenforce 1

# Resolve the user's configured shell and try running it
SHELL_BIN=$(getent passwd "$USER" | cut -d: -f7)
echo "$SHELL_BIN"
sudo -u username "$SHELL_BIN" -c 'echo shell-ok'

# Check for missing shared libraries ("not found" lines indicate the problem)
ldd "$SHELL_BIN"

# Inspect the current value (may not exist)
Get-ItemProperty -Path 'HKLM:\SOFTWARE\OpenSSH' -Name DefaultShell -ErrorAction SilentlyContinue

# Set PowerShell as the default shell (verify the path exists first)
New-ItemProperty -Path 'HKLM:\SOFTWARE\OpenSSH' -Name DefaultShell `
  -Value 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' `
  -PropertyType String -Force

# Or use cmd.exe instead:
# -Value 'C:\Windows\System32\cmd.exe'

Restart-Service sshd