FortiPAM allows you to protect, isolate and secure privileged account credentials, manage and control privileged user access, and monitor and record privileged account activity.
Article Id 254332
Description The article describes some typical password changing failed reason with SSH Server, and how to debug it.
Scope FortiPAM, Target SSH Server.

1) Typical Failed scenarios:


- Scenario 1: Incorrect username and password configured for secret in PAM.
PAM shows 'LIBSSH2_ERROR_Authentication_Failed'.

- Scenario 2:  SSH Server is unreachable from FortiPAM.
PAM shows 'Connection failure, no routes to host'.

- Password-changer procedure does not match Target SSH Server.
PAM shows 'Not match at step [x]'.

- New generated password by PAM does not meet SSH Server Requirements
PAM can show 'Not match at step [x]' or 'LIBSSH2_ERROR_Authentication_Failed'.


2) How to debug password changing?

Run the below command on PAM Shell or console:


# diag debug en

# diag wad debug en category pwdchg

# diag wad debug en level verbos


After the debug finishes, run the below command to disable debug:


# diag wad debug clear

# diag debug disable