FAQs

This page covers common troubleshooting scenarios and useful commands for managing the 1Kosmos Linux PAM.

---

Troubleshooting

A user cannot log in via SSH after PAM installation. Where do I start?

Check logs in this order:

1. 1Kosmos PAM logs: /var/log/blockId/blockId.log

2. SSHD system logs: journalctl -t sshd -r

3. SELinux audit logs (if SELinux is enabled): ausearch -m avc -ts recent

PAM configuration seems correct but SSH login is still failing. What could be wrong?

Verify that no auth rule in password-auth or sshd has a control flag of sufficient or success=done — these bypass subsequent PAM rules including 1Kosmos. Also confirm the sshd service has been restarted after any configuration changes.

SELinux is blocking the 1Kosmos PAM. How do I fix it?

Set SELinux to permissive mode (setenforce 0), SSH into the host to generate audit logs, create a semodule using audit2allow, install it with semodule -i, then re-enable enforcing mode (setenforce 1). See the Installation page for the full steps.

I made changes to the PAM files and locked myself out. What should I do?

This is why it is recommended to keep an additional root shell open before making changes. If you are locked out, you will need console access to the host to revert the PAM file changes from the backup you created before modifying them.

Useful Commands

What are the key commands for managing the sshd service?

Task	Command
Check sshd status	systemctl status sshd
Stop sshd	systemctl stop sshd
Start sshd	systemctl start sshd
Restart sshd	systemctl restart sshd
Check SELinux status	sestatus
Disable SELinux (current session)	setenforce 0
Enable SELinux (current session)	setenforce 1