Why does SSH stop accepting PW, works fine after reboot.

benisai · March 17, 2023

I'm using the newest Ubuntu image for my RockPi4C+, and from time to time, I try to login, but it wont allow it. If I reboot, I can login just fine. I tried from 2 devices, both devices could not ssh into the pi.

running a cat on /var/log/auth.log doesnt show any attempts at all. After a reboot, I cat the log and can see my login attempts present after the reboot. Its like the sshd service is dying.

Mar 17 00:15:01 rockpi-4cplus CRON[1869]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0)
Mar 17 00:15:01 rockpi-4cplus CRON[1868]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0)
Mar 17 00:15:01 rockpi-4cplus CRON[1869]: pam_unix(cron:session): session closed for user root
Mar 17 00:15:01 rockpi-4cplus CRON[1868]: pam_unix(cron:session): session closed for user root
Mar 17 00:17:01 rockpi-4cplus CRON[1883]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0)
Mar 17 00:17:01 rockpi-4cplus CRON[1883]: pam_unix(cron:session): session closed for user root
Mar 17 00:22:48 rockpi-4cplus sudo: ben : TTY=pts/0 ; PWD=/home/ben ; USER=root ; COMMAND=/usr/sbin/service ssh restart
Mar 17 00:22:48 rockpi-4cplus sudo: pam_unix(sudo:session): session opened for user root(uid=0) by ben(uid=1000)
Mar 17 00:22:48 rockpi-4cplus sshd[965]: Received signal 15; terminating.
Mar 17 00:22:48 rockpi-4cplus sshd[1903]: Server listening on 0.0.0.0 port 22.
Mar 17 00:22:48 rockpi-4cplus sshd[1903]: Server listening on :: port 22.
Mar 17 00:22:48 rockpi-4cplus sudo: pam_unix(sudo:session): session closed for user root
Mar 17 00:22:52 rockpi-4cplus sudo: ben : TTY=pts/0 ; PWD=/home/ben ; USER=root ; COMMAND=/usr/sbin/service ssh status
Mar 17 00:22:52 rockpi-4cplus sudo: pam_unix(sudo:session): session opened for user root(uid=0) by ben(uid=1000)
Mar 17 00:22:52 rockpi-4cplus sudo: pam_unix(sudo:session): session closed for user root
Mar 17 00:25:01 rockpi-4cplus CRON[1911]: pam_unix(cron:session): session opened for user root(uid=0) by (uid=0)
Mar 17 00:25:01 rockpi-4cplus CRON[1911]: pam_unix(cron:session): session closed for user root
Mar 17 00:27:21 rockpi-4cplus sudo: ben : TTY=pts/0 ; PWD=/home/ben ; USER=root ; COMMAND=/usr/bin/cat /var/log/auth.log
Mar 17 00:27:21 rockpi-4cplus sudo: pam_unix(sudo:session): session opened for user root(uid=0) by ben(uid=1000)

Can someone help? I dont know what else to look at.

I checked the Journal but nothing.

ben@rockpi-4cplus:~$ journalctl | grep sshd
Mar 16 23:17:10 rockpi-4cplus sshd[965]: Server listening on 0.0.0.0 port 22.
Mar 16 23:17:10 rockpi-4cplus sshd[965]: Server listening on :: port 22.
Mar 17 00:11:24 rockpi-4cplus sshd[1664]: Accepted password for ben from 10.0.0.245 port 56146 ssh2
Mar 17 00:11:24 rockpi-4cplus sshd[1664]: pam_unix(sshd:session): session opened for user ben(uid=1000) by (uid=0)
Mar 17 00:22:48 rockpi-4cplus sshd[965]: Received signal 15; terminating.
Mar 17 00:22:48 rockpi-4cplus sshd[1903]: Server listening on 0.0.0.0 port 22.
Mar 17 00:22:48 rockpi-4cplus sshd[1903]: Server listening on :: port 22.

Edited March 17, 2023 by benisai