I cannot login to IBM i server

[pranab101]

I cannot login to IBM i server. I have all my credentials correct but I get the error stating invalid credentials.

Here is the screenshot of the error

extension version 2.13.0

IBM i ACS version 1.1.9.4

[sebjulliand]

Double-check your password (check caps-lock, avoid copy/paste, mind the case sensitivity of your password if your IBM i requires it).

Try a third-party tool like putty (on Windows) or ssh in a terminal (on MacOS/Linux) and try to connect using this tool to validate that:

• credentials are actually OK
• the SSH server on IBM i accepts your credentials

[madangunasekaran]

I still get the same error though I copy and pasted the credentials.

[sebjulliand]

@pranab101 @madangunasekaran Try a third-party tool like putty (on Windows) or ssh in a terminal (on MacOS/Linux) and see if you can connect using one of these tools. This should help understand on which end the issue is.

[madangunasekaran]

I have used the Putty as well on Windows and still getting an error.

Below is the message from Putty:

login as: mgunasek99 mgunasek99@gm400dev's password: Access denied mgunasek99@gm400dev's password:

Also, the backend job log QP0ZSPWP shows below. I have made sure that the password is correct and Dont see the id not disabled. My admin was able to login thru putty and I am not sure what is preventing me to login thru the putty for me.

sshd[110041]: Invalid user mgunasek99 from 10.99.67.42 port 63069
sshd[110041]: Failed password for invalid user mgunasek99 from 10.99.67.42 port 63069 ssh2

[julesyan]

Are you able to check which shell is set up? You can through SQL (make sure your username is all caps):

SELECT AUTHORIZATION_NAME, PASE_SHELL_PATH FROM QSYS2.USER_INFO WHERE AUTHORIZATION_NAME = 'USERNAME'

If there is a value you can check if that shell still exists. If not it should default to /OpenSys/usr/bin/bsh for ssh connections, which should exist if your admin was able to login (can't hurt to check though). Sometimes it throws this error when it cant find the configured shell.

[sebjulliand]

Good thinking @julesyan ! I'd advise the default shell to be /QOpenSys/pkgs/bin/bash though.

[chrjorgensen]

@madangunasekaran If your IBM i release is before 7.4, then by default the SSH server does not allow user name longer than 8 characters. And your user name mgunasek99 exceeds that limit.

But this can be circumvented: You can ask your admin to allow longer user names by having him/her set the following environment on a system level:

ADDENVVAR ENVVAR(PASE_USRGRP_LIMITED) VALUE('N') LEVEL(*SYS)

After at restart of the SSH server, the limit is no longer there and your user name is allowed.

Read more about this SSH limitation here: https://www.seidengroup.com/2015/02/06/overcome-8-character-user-profile-limit-ssh-ibm-i/

Ideally, your admin should also have set security on the SSH server to only allow privileged users to access the server through SSH! SSH is a well known cross-platform service and used extensively by hackers. Your admin can control which users may login through SSH as described in this article by the security guru Carol Woodbury: https://www.mcpressonline.com/security/ibm-i-os400-i5os/controlling-access-to-ssh-on-ibm-i

[chrjorgensen]

@madangunasekaran Did you succeed in connecting to your system? Can we close this case?