What Do I Do If "Permission denied, please try again" Is Reported When I SSH Into a Linux ECS?

Symptom

When I log in to a Linux ECS using SSH, the error message "Permission denied, please try again" is displayed.

Figure 1 Error message

Run the cat /var/log/secure command to view login logs. The following error information is displayed:

Permission denied, please try again.
User test from 192.168.xxx.xxx not allowed because not listed in AllowUsers.
User test from 192.168.xxx.xxx not allowed because listed in DenyUsers.
User root from 192.168.xxx.xxx not allowed because a group is listed in DenyGroups.
User test from 192.168.xxx.xxx not allowed because none of user's groups are listed in AllowGroups.

Possible Causes

The user login control parameters are enabled in the SSH remote login configuration file (/etc/ssh/sshd_config) of the ECS. The user login control parameters are described as follows:

• AllowUsers: indicates the whitelist of users who are allowed for login. Only the users specified by this parameter can log in to the ECS.
• DenyUsers: indicates the blacklist of users who are not allowed for login. All users specified by this parameter are not allowed to log in to the ECS.
• AllowGroups: indicates the whitelist of user groups that are allowed for login. Only the users in the groups specified by this parameter can log in to the ECS.
• DenyGroups: indicates the blacklist of user groups that are not allowed for login. All users in the groups specified by this parameter are not allowed to log in to the ECS.

The deny policy has a higher priority than the allow policy. The details are as follows:

• If AllowUsers and DenyUsers both contain the same user, the user cannot log in to the ECS because the deny policy takes precedence.
• If a user in AllowUsers is in the user group specified by DenyGroups, the user cannot log in to the ECS because the deny policy takes precedence.

Solution

You can modify the user login control parameters in the SSH remote login configuration file (/etc/ssh/sshd_config) to solve this problem.

1. Log in to the Linux ECS using VNC.

   For details, see Logging In to a Linux ECS Using VNC.

2. Run the following command to view the sshd_config file:

   cat /etc/ssh/sshd_config

   If information similar to the following is displayed, the test user is not allowed to log in to the ECS:

   AllowUsers root test 
   DenyUsers test 
   DenyGroups test 
   AllowGroups root

3. Modify user login control parameters.
   1. Run the following command to open the SSH configuration file:

      vi /etc/ssh/sshd_config

   2. Modify user login control parameters based on service requirements.

      Add a number sign (#) before the policy configuration items to cancel user access control, ensuring that related users can log in to the ECS.

      #AllowUsers root test 
      #DenyUsers test 
      #DenyGroups test 
      #AllowGroups root

   3. Press Esc and enter :wq to save the changes.
4. Log in to the Linux ECS again and ensure that the login is successful.