So we've all had this, haven't we?
I can't log in.
But don't worry, there are things that we can do about this.
So a lot to do is about gathering information,
collecting information from that user.
So the login name including exactly what they are typing, including the case.
Linux names are going to be case sensitive much in the way as
most things are case sensitive in Linux.
We can go through and look at the status of their password if
they're using password‑based authentication,
so passwd ‑S is going to allow us then to specify the username to interrogate.
Of course, this would need to be elevated.
We can also go through and see similar information with the chage ‑L,
although we don't get to see whether the account is locked or not.
Are they logging in via the console or are they logging
in via SSH or some other mechanism?
We might find that SSH logins have been disabled for
password‑based authentication,
and maybe only key‑based authentication is allowed.
So are they using key‑based authentication or are they using a password?
What message is being displayed?
That might help us begin the complete message,
and how many times it's being displayed will give us some
clues as to what might be going on.
We can also use the lastb command.
This might give us an idea to see if somebody's really trying to
break into the account and perhaps locking an account because of
so many failed login attempts.
So there's a lot that we can gather,
but it's just trying to get the information before we react.
Let's just go through, gather as much information as possible,
and then try and work out what the problem is,
rather than just dealing with that I can't log in.
Oh, well, let's have a look.
Well, no, we've done it wrong, haven't we?
We need to gather that information, and then once we've got all of that,
then hopefully everything is going to be lovely and happy with our users.
Come on,
let's go out to our command line and take a look at how
we can research some of these issues.
So we'll be taking a look at our SSH settings,
our password aging information, and locking and unlocking account,
and the lastb command.
So as we find ourselves in the glorious horizons of our Ubuntu 2004 system,
we can start investigating some of the things that
might cause problems to our users.
The first thing is that we're using a Vagrant machine.
The default account on that would be Vagrant,
but we also have an Ubuntu account.
The Ubuntu account doesn't have a password.
We're going to be investigating that Ubuntu account,
but we're going to first set the account to have a password.
Things like password locking and unlocking won't work
where we don't have a password, it won't allow me to unlock the account.
So we're assuming the user would have a password,
but we're just making sure that there definitely is
a password set for our account.
So we're going to use sudo, and then we can go through into our passwd command,
and then specify the user account, so that's going to be our Ubuntu account.
So I'm going to set the password,
and lets say we're not assuming that we do need to reset the password,
just making sure that this built‑in account to our image
actually does have a password from the outset.
So even though we're logging in by Vagrant,
we have got another account that we can use but that
just doesn't have a password set.
If we now go through and take a look at the status of our passwords,
that's passwd ‑S, we can see then the Ubuntu account,
and again,
we've got to be very careful that the user is actually
typing Ubuntu with lowercase characters.
They might be used to type in their name with an
uppercase character for the first character,
it's sensible enough,
but Linux is case sensitive as far as the username is concerned.
We can see the password is set with the uppercase P,
we can see where the password was last changed,
and then those last four fields,
0 is representing that there is no minimum time we have to
have a password before we can change it.
Essentially,
I don't have to change my password because I have
to change it every 99,000 days.
I get a warning though, thankfully, seven days before my password expires,
and the ‑1 is the inactivity period that we're looking at,
and it's specifying that if I haven't logged in for a period
of time after my password has expired, we're not going to lock the account.
If I go through and let's say I need to speak with a user,
it's quite reasonable that I lock the account.
The user then tries to log in with the password,
they're not going to be able to get in.
So if I do something like su ‑ubuntu, I can put in then the correct password,
but we're going to get an authentication failure coming back.
Now we don't really know what's causing the problem,
it's just an authentication failure, but we can try again,
maybe we did get the password wrong, but again,
when I try it the second time I'm still not getting in,
and I'm pretty certain I typed in the password correctly.
So it's this then that might lead us to dig a little bit deeper.
When we go through and take a look though,
as we go through and take a look at our status,
we can see then that we've got the uppercase L now,
indicating that the user account is locked.
Once we have then spoken with our user with whatever
information we needed to give them, we can now unlock the account,
and then hopefully they're able to log back in again.
So here where I'm using su ‑, I'm switching to the Ubuntu account,
I'm adding in the correct password, or what I thought.
Now it still might be just bad finger action going on,
but if we then go through and try again,
but this time make sure that we add the correct password,
we can see now that we have got in.
So it is just a matter of making sure that we are typing the
right username and the right password and,
of course, the account isn't locked.
But that's not the only thing that might be stopping us.
If we go through and take a look at our password aging information,
we can go through and see that same type of information
that we saw from our password status,
but it just gives it a better explanation of everything that can be set.
And we can see things such as an account expiry,
where an expiry date may have been set on.
But also, when we take a look at the method of authentication,
so if we're using password authentication but we're not on the console,
we're using SSH.
Remember, our password here is being used with su, not with SSH.
And we go through and then check for password
authentication inside of our SSHD configuration,
we can see that password authentication is not allowed.
So if the user is trying to log on over SSH using a password,
we have to say no that's not possible, you have to use key‑based authentication,
and let's get you set up for key‑based authentication.
So there's lots of things that we can look at,
but also, we might be genuinely using password‑based authentication.
Taking a look at lastb, we can see then the failed login attempts,
the last bad login, it's all been for Ubuntu.
But if we're seeing many of these in a short amount of time,
perhaps the account is being locked out because of the failed logins
and someone's trying to break into their account.
Again,
really important information that we can gather rather than just resetting a user's password.