Azure / Azure/azure-linux-extensions
AADLoginForLinux does not work after adding authorized keys
- Dominant language
- Python
- Stars
- 333
- Forks
- 278
- Avg merge
- 2d 9h
- Merged PRs (30d)
- 4
Description
I have ubuntu 18.04 vm -
```
cat /etc/os-release
NAME="Ubuntu"
VERSION="18.04.5 LTS (Bionic Beaver)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 18.04.5 LTS"
VERSION_ID="18.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=bionic
UBUNTU_CODENAME=bionic
```
I installed the Azure AD login extension following https://docs.microsoft.com/en-us/azure/virtual-machines/linux/login-using-aad#install-the-azure-ad-login-vm-extension .
When logging in initially, i get the device login prompt with the code and i am able to ssh in after confirming the code and signing in.
I would not like to ssh interactively every time, so i added my ssh keys with `ssh-copy-id` command. After that, i fail to login and get the message "Connection closed by xx.xx.xx.xx port 22" .
i can login with the azureuser key and i see the following logs in "/var/log/auth.log" -
```
Jan 29 20:18:23 cluster-bastion sshd[9154]: pam_aad(sshd:account): AadAuthorize, Version: 1.0.014760002; CorrelationId: bebdd9f5-c357-4056-9c1c-62c73a59ac35
Jan 29 20:18:23 cluster-bastion sshd[9154]: pam_aad(sshd:account): AadAuthenticate, Version: 1.0.014760002; CorrelationId: bebdd9f5-c357-4056-9c1c-62c73a59ac35
Jan 29 20:18:24 cluster-bastion sshd[9154]: pam_aad(sshd:account): Failed to call back client. Make sure ChallengeResponseAuthentication in /etc/ssh/sshd_config is set to 'yes'.
Jan 29 20:18:24 cluster-bastion sshd[9154]: fatal: Access denied for user saswata.chakravarty@neuralconcept.com by PAM account configuration [preauth]
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Reproduce the failure on Ubuntu 18.04 after using ssh-copy-id and installing the Azure AD login VM extension from the linked documentation. Start with /var/log/auth.log and /etc/ssh/sshd_config, checking the reported ChallengeResponseAuthentication setting; done means key-based login works without the device login prompt or PAM account denial.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, linux, ubuntu
- Domain
- authentication, operating-systems
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100