Azure / Azure/azure-linux-extensions

AADLoginForLinux does not work after adding authorized keys

Open
#1,294 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
333
Forks
278
Avg merge
2d 9h
Merged PRs (30d)
4

Description

I have ubuntu 18.04 vm -

```
cat /etc/os-release
NAME="Ubuntu"
VERSION="18.04.5 LTS (Bionic Beaver)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 18.04.5 LTS"
VERSION_ID="18.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=bionic
UBUNTU_CODENAME=bionic
```

I installed the Azure AD login extension following https://docs.microsoft.com/en-us/azure/virtual-machines/linux/login-using-aad#install-the-azure-ad-login-vm-extension .

When logging in initially, i get the device login prompt with the code and i am able to ssh in after confirming the code and signing in.

I would not like to ssh interactively every time, so i added my ssh keys with `ssh-copy-id` command. After that, i fail to login and get the message "Connection closed by xx.xx.xx.xx port 22" .

i can login with the azureuser key and i see the following logs in "/var/log/auth.log" -

```
Jan 29 20:18:23 cluster-bastion sshd[9154]: pam_aad(sshd:account): AadAuthorize, Version: 1.0.014760002; CorrelationId: bebdd9f5-c357-4056-9c1c-62c73a59ac35
Jan 29 20:18:23 cluster-bastion sshd[9154]: pam_aad(sshd:account): AadAuthenticate, Version: 1.0.014760002; CorrelationId: bebdd9f5-c357-4056-9c1c-62c73a59ac35
Jan 29 20:18:24 cluster-bastion sshd[9154]: pam_aad(sshd:account): Failed to call back client. Make sure ChallengeResponseAuthentication in /etc/ssh/sshd_config is set to 'yes'.
Jan 29 20:18:24 cluster-bastion sshd[9154]: fatal: Access denied for user saswata.chakravarty@neuralconcept.com by PAM account configuration [preauth]
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the failure on Ubuntu 18.04 after using ssh-copy-id and installing the Azure AD login VM extension from the linked documentation. Start with /var/log/auth.log and /etc/ssh/sshd_config, checking the reported ChallengeResponseAuthentication setting; done means key-based login works without the device login prompt or PAM account denial.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, linux, ubuntu
Domain
authentication, operating-systems
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.