Unable to SSH with the user after keymaker is installed in the instances

[pradeepasuri]

Hi Kislyuk,

We have configured keymaker in our EC2 instances long back, we were able to access all the instances with our usernames earlier. But after we changed our AMI image, keymaker started working only in few instances not all the instances. The roles which are attached to the instances have the same policies as per the keymaker document.

When I tried to login with my username into the hosts which are not accessible via the user name it creates a user in those hosts, but where as next time when we tried to login with the same username it is not allowing that user to login.

Is there anyway we can look into keymaker logs ?

Below are the errors which we have seen from audit and secure.

secure-20200628:Jun 23 09:15:34 hostname usermod[24099]: add 'username' to shadow group
'users'
secure-20200628:Jun 23 09:15:34 hostname sshd[24061]: Postponed keyboard-interactive f
or invalid user asurip from IP port 37646 ssh2 [preauth]

secure-20200628:Jun 23 09:19:29 hostname sshd[24219]: error: AuthorizedKeysCommand /us
r/sbin/keymaker-get-public-keys user failed, status 1
secure-20200628:Jun 23 09:32:03 hostname sshd[24637]: erro

audit/audit.log.4:type=AVC msg=audit(1592903733.792:258113): avc: denied { write } for pid=24081 comm="useradd
" path="/home/username/.bash_logout" dev="dm-1" ino=393218 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontex
t=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1

audit/audit.log.4:type=USER_AUTH msg=audit(1592903962.816:258217): pid=24197 uid=0 auid=4294967295 ses=4294967295
subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=pubkey acct="asurip" exe="/usr/sbin/sshd" hostname=? addr=1
terminal=ssh res=failed'
audit/audit.log.4:type=USER_LOGIN msg=audit(1592903964.073:258224): pid=24197 uid=0 auid=4294967295 ses=429496729
5 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=login acct="asurip" exe="/usr/sbin/sshd" hostname=? addr=1
terminal=ssh res=failed'

Could you please help me out how to fix this issue.

Thanks,
Pradeep A

[pradeepasuri]

Do you have any update on this ?