How to fix error: PAM: Authentication failure for user from hostname in SSH

SSHINTERMEDIATEMEDIUMUpdated Oct 28, 2026· 598 views

PAM (Pluggable Authentication Modules) authentication fails during SSH login. This typically means the authentication module rejected the credentials or user account. Common causes include incorrect passwords, disabled user accounts, invalid PAM configuration, or SSH/PAM incompatibilities after system updates.

Quick fix

Fixes error: PAM: Authentication failure for user from hostname

login
# Enter username and password
  1. Verify username and password are correct
  2. Check if local console login works
  3. Review system authentication logs
  4. Verify the user account is not disabled or expired
ssh — error
login
# Enter username and password
error: PAM: Authentication failure for user from hostname

What this error means

PAM is a flexible authentication framework that SSH uses to validate user credentials. When you see "error: PAM: Authentication failure for user from hostname," it means the PAM subsystem on the SSH server rejected your login attempt. This can happen at various stages: password verification through pam_unix, directory service lookups (LDAP/SSSD), account status checks, or PAM module configuration issues. The error is logged by sshd when authentication fails, appearing in system logs like /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL/CentOS).

Typical symptoms

  • SSH login fails with "PAM: Authentication failure" in logs despite correct password
  • Local console login works but SSH login fails
  • Error appears in /var/log/auth.log or /var/log/secure
  • Some users can login but others cannot
  • SSH fails after system update or openssh upgrade

Common causes

  1. Incorrect username or password entered
  2. User account is disabled, locked, or expired
  3. Special characters in password misinterpreted due to keyboard layout differences
  4. User's shell is invalid or missing from the system
  5. PAM configuration in /etc/pam.d/sshd is misconfigured
  6. OpenSSH configuration (sshd_config) has incompatible settings
  7. Directory service (LDAP/SSSD/Kerberos) authentication module failure
  8. PAM authentication method conflict (PasswordAuthentication vs KbdInteractiveAuthentication)

How to fix "error: PAM: Authentication failure for user from hostname"

1Verify username and password are correct

Double-check that you are entering the correct username and password. Pay special attention to:

- Capitalization (usernames and passwords are case-sensitive)
- Special characters that may be interpreted differently on various keyboard layouts
- Spaces before or after the username

If you're using a special character like (, ), @, or #, try using a simpler password temporarily to isolate keyboard layout issues.

2Check if local console login works

If you have physical or console access, try logging in locally at the terminal:

bash
login
# Enter username and password

If local login succeeds but SSH fails, the issue is SSH/PAM configuration, not account status. If local login also fails, the account itself is likely disabled or password-related.

3Review system authentication logs

Check the SSH authentication logs for more detailed error messages:

On Debian/Ubuntu:

bash
sudo tail -f /var/log/auth.log
# Look for lines with "sshd", "PAM", and the username

On RHEL/CentOS:

bash
sudo tail -f /var/log/secure
# Look for lines with "sshd", "PAM", and the username

The logs may reveal the specific PAM module that failed (e.g., pam_unix, pam_sss, pam_ldap).

4Verify the user account is not disabled or expired

As root or with sudo, check the account status:

bash
# Check if account is locked
sudo passwd -S username

# Check expiration date
sudo chage -l username

# Verify user shell is valid
sudo getent passwd username
# Look for the shell in /etc/shells
cat /etc/shells

If the account is locked (marked with LK or similar), unlock it:

bash
sudo passwd -u username

If the shell is invalid, update it:

bash
sudo usermod -s /bin/bash username
5Check SSH daemon configuration

Review /etc/ssh/sshd_config for incompatible settings:

bash
sudo grep -E "^(UsePAM|PasswordAuthentication|ChallengeResponseAuthentication|PermitRootLogin)\s" /etc/ssh/sshd_config

Ensure these are set appropriately:

bash
UsePAM yes
PasswordAuthentication yes
ChallengeResponseAuthentication no
# OR for key-only auth:
# PasswordAuthentication no

After making changes, validate and reload:

bash
sudo sshd -t
sudo systemctl restart ssh  # or sshd
6Verify PAM configuration if using directory services

If you're using LDAP, Kerberos, or SSSD for authentication, check if the directory service is responding:

bash
# Test LDAP connectivity (if using LDAP)
sudo ldapsearch -x -H ldap://ldapserver -D "cn=admin,dc=example,dc=com" -W

# Check SSSD status (if using SSSD)
sudo systemctl status sssd
sudo sssd -d 0x0fff  # Enable verbose logging

# Verify identity provider is working
getent passwd username
getent group groupname

If directory service is unreachable, resolve connectivity before attempting SSH login.

Advanced notes

PAM failures can have different root causes depending on the authentication stack. When PAM processing includes pam_unix (local authentication), you'll see "pam_unix(sshd:auth): authentication failure" before PAM reports the overall failure. If using sssd or LDAP, the first pam_unix failure is expected (it tries local first), followed by pam_sss success. This is normal behavior. The "UsePAM yes" directive in sshd_config enables PAM for account and session checks; when combined with PasswordAuthentication yes, it enforces PAM authentication. This provides security benefits (password policies, session logging) but requires correct PAM configuration. On systems with recent OpenSSH updates, incompatibility between PasswordAuthentication and ChallengeResponseAuthentication can cause PAM authentication to be rejected. If keyboard-interactive (challenge-response) authentication is enabled, disable one method or ensure both are properly configured in /etc/pam.d/sshd. For rootless systems or containers, PAM may not be available, requiring UsePAM no and key-based authentication instead.

Frequently asked questions

What does "error: PAM: Authentication failure for user from hostname" mean?
PAM is a flexible authentication framework that SSH uses to validate user credentials. When you see "error: PAM: Authentication failure for user from hostname," it means the PAM subsystem on the SSH server rejected your login attempt. This can happen at various stages: password verification through pam_unix, directory service lookups (LDAP/SSSD), account status checks, or PAM module configuration issues.
How do I fix "error: PAM: Authentication failure for user from hostname"?
PAM (Pluggable Authentication Modules) authentication fails during SSH login. This typically means the authentication module rejected the credentials or user account. Common causes include incorrect passwords, disabled user accounts, invalid PAM configuration, or SSH/PAM incompatibilities after system updates.
What causes "error: PAM: Authentication failure for user from hostname"?
Incorrect username or password entered User account is disabled, locked, or expired Special characters in password misinterpreted due to keyboard layout differences
Is the "error: PAM: Authentication failure for user from hostname" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading