SSH failed with "Permission denied, please try again."

When SSH to Linux host with correct username and password, failed with following messages

Permission denied, please try again.

Check sshd log with following command,

journalctl -u sshd

Find out entries which timestamp are close to the time when you failed to login. For example,

Aug 27 15:50:46 exacel01 sshd[880370]: Connection from 10.197.227.96 port 50679 on 10.200.252.81 port 22
Aug 27 15:50:47 exacel01 sshd[880370]: Failed publickey for celladmin from 10.197.227.96 port 50679 ssh2: RSA SHA256:WVGS1P414sH7GEphKYsL8l/+>
Aug 27 15:50:48 exacel01 sshd[880370]: pam_lastlog(sshd:auth): user celladmin inactive for 77 days - denied
Aug 27 15:50:50 exacel01 sshd[880370]: Failed password for celladmin from 10.197.227.96 port 50679 ssh2

The login is being rejected by the PAM module pam_lastlog because the account has been considered inactive for 77 days. 

Check PAM configuration with following command,

grep -R lastlog /etc/pam.d

The output

[root@exacel01]# grep -R lastlog /etc/pam.d
/etc/pam.d/system-auth:auth     required   pam_lastlog.so inactive=35
/etc/pam.d/password-auth:auth   required   pam_lastlog.so inactive=35
/etc/pam.d/postlogin:session required pam_lastlog.so showfailed

The PAM configuration contains

auth required  pam_lastlog.so inactive=35

In both following files

/etc/pam.d/system-auth

/etc/pam.d/password-auth

And the SSH log shows:

pam_lastlog(sshd:auth): user celladmin inactive for 77 days - denied

Since 77 > 35, PAM is denying authentication before password validation succeeds.

Solution 1 (recommended): Update the last login record

As root on the host, run following commands in order

   su - celladmin

   exit

   lastlog -u celladmin

Solution 2 : Increase the inactive threshold

Edit files

/etc/pam.d/system-auth

/etc/pam.d/password-auth

Change 

auth required  pam_lastlog.so inactive=35

To

auth required  pam_lastlog.so inactive=90

Solution 3 : Disable the inactive check

Remove "inactive=35" from both files.