-
Bug
-
Resolution: Unresolved
-
Undefined
-
None
-
rhel-9.7
-
None
-
None
-
None
-
rhel-systemd
-
None
-
False
-
False
-
-
None
-
None
-
None
-
None
-
Unspecified
-
Unspecified
-
Unspecified
-
-
x86_64
-
None
When running ssh in a frequent loop such as:
$ while [ 1 ]; do ssh test@host sync; done
This creates the following audit log message once:
type=CRED_ACQ msg=audit(1770714583.655:1405): pid=4100 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='op=PAM:setcred grantors=? acct="test" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'UID="root" AUID="unset"
This seems to happen for accounts that have not logged in to the system in a while (a few minutes, so all systemd instances are stopped and there are no processes running under that user at all). The PID mentioned in the audit message is systemd's user instance. There is nothing relevant in the logs, other than systemd starting the User Manager:
Feb 10 10:09:43 r96.example.com systemd[1]: Starting User Manager for UID 1003... Feb 10 10:09:43 r96.example.com systemd[4100]: pam_unix(systemd-user:session): session opened for user test(uid=1003) by test(uid=0) Feb 10 10:09:43 r96.example.com systemd[4100]: Queued start job for default target Main User Target. Feb 10 10:09:43 r96.example.com systemd[4100]: Created slice User Application Slice. Feb 10 10:09:43 r96.example.com systemd[4100]: Started Mark boot as successful after the user session has run 2 minutes. Feb 10 10:09:43 r96.example.com systemd[4100]: Started Daily Cleanup of User's Temporary Directories. Feb 10 10:09:43 r96.example.com systemd[4100]: Reached target Paths. Feb 10 10:09:43 r96.example.com systemd[4100]: Reached target Timers. Feb 10 10:09:43 r96.example.com systemd[4100]: Starting D-Bus User Message Bus Socket... [...]
