CentOS 7 中仅root可正常操作，其他本地用户无法通过su或ssh切换/登录的问题求助

大家好，今天我碰到了一个棘手的问题：在我的CentOS 7机器上，所有本地用户都没法通过su切换身份，也没法通过ssh登录了，只有root账号能正常操作。下面是具体的情况和我已经排查过的步骤，希望能得到大家的帮助，谢谢！

问题复现步骤及错误信息 #

我新建了一个测试用户ndejay并设置密码后，尝试切换和登录：

$ adduser ndejay
$ passwd ndejay
Changing password for user ndejay.
New password:
Retype new password:

尝试用su切换到该用户时直接报错：

$ su ndejay
su: failed to execute /bin/bash: Permission denied

用ssh本地登录同样失败：

$ ssh ndejay@localhost
ndejay@localhost's password:
Could not chdir to home directory /home/ndejay: Permission denied
/bin/bash: Permission denied
Connection to localhost closed.

已完成的排查操作 #

1. 检查文件/目录权限
   我确认了用户家目录、bash所在路径的权限看起来都是正常的：

$ ls -ld /home /home/ndejay
drwxr-xr-t. 10 root   root   4096 Feb 27 18:13 /home
drwx------   2 ndejay ndejay   85 Feb 27 18:13 /home/ndejay

$ ls -ld /bin /usr/bin /usr/bin/bash
lrwxrwxrwx. 1 root root      7 Oct  1  2015 /bin -> usr/bin
dr-xr-xr-x. 2 root root  36864 Jan  9 17:51 /usr/bin
-rwxr-xr-x. 1 root root 960384 Mar  5  2015 /usr/bin/bash

2. 确认SELinux状态
   已经确认SELinux是关闭的：

$ getenforce
Disabled

3. 查看系统安全日志
   查看/var/log/secure日志，发现有sssd相关的错误：

$ tail /var/log/secure
Feb 27 18:13:28 fs01 su: pam_unix(su:session): session opened for user ndejay by (uid=0)
Feb 27 18:13:28 fs01 su: pam_sss(su:session): Request to sssd failed. Connection refused

4. 尝试禁用sssd
   我尝试禁用sssd服务，但问题依旧：

$ authconfig --savebackup /root/230227-authconfig
$ authconfig --disablesssd --disablesssdauth --update

之后的日志显示会话能打开但还是无法正常登录：

$ tail /var/log/secure
Feb 27 18:35:24 fs01 su: pam_unix(su:session): session opened for user ndejay by (uid=0)
Feb 27 18:35:24 fs01 su: pam_unix(su:session): session closed for user ndejay
Feb 27 18:40:25 fs01 sssd[14272]: Accepted password for ndejay from 172.21.13.11 port 53132 ssh2
Feb 27 18:40:25 fs01 sshd[14272]: pam_unix(sshd:session): session opened for user ndejay by (uid=0)
Feb 27 18:40:25 fs01 sshd[14344]: Received disconnect from 172.21.13.11: 11: disconnected by user
Feb 27 18:40:25 fs01 sshd[14272]: pam_unix(sshd:session): session closed for user ndejay

更新排查内容（编辑1） #

根据建议检查了磁盘空间和inode使用情况，看起来都没有占满：

$ df -h
Filesystem                                           Size  Used Avail Use% Mounted on
/dev/mapper/centos-root                              222G  100G  123G  45% /
devtmpfs                                             7.8G     0  7.8G   0% /dev
tmpfs                                                7.8G     0  7.8G   0% /dev/shm
tmpfs                                                7.8G   41M  7.7G   1% /run
tmpfs                                                7.8G     0  7.8G   0% /sys/fs/cgroup
/dev/sdb1                                            4.7G  174M  4.5G   4% /boot
/dev/mapper/centos-home                               47G  122M   47G   1% /home
tmpfs                                                1.6G     0  1.6G   0% /run/user/0
tmpfs                                                1.6G     0  1.6G   0% /run/user/12002

$ df -i
Filesystem                                              Inodes    IUsed      IFree IUse% Mounted on
/dev/mapper/centos-root                              232411136  2806233  229604903    2% /
devtmpfs                                               2026378      497    2025881    1% /dev
tmpfs                                                  2028949        1    2028948    1% /dev/shm
tmpfs                                                  2028949      711    2028238    1% /run
tmpfs                                                  2028949       13    2028936    1% /sys/fs/cgroup
/dev/sdb1                                              4882432      337    4882095    1% /boot
/dev/mapper/centos-home                               48828416      889   48827527    1% /home
tmpfs                                                  2028949        1    2028948    1% /run/user/0
tmpfs                                                  2028949        1    2028948    1% /run/user/12002

更新排查内容（编辑2） #

开启了sshd的调试模式，获取到更多日志信息：

• 服务器端启动调试：

$ /usr/sbin/sshd -ddd -p 222
...
Server listening on :: port 222.

• 客户端登录时的输出：

$ ssh -p 222 ndejay@fs01
Last login: Mon Feb 27 18:40:25 2023 from d1p-hydratm01.ldi.lan
debug3: mm_request_send entering: type 124
debug3: mm_request_receive_expect entering: type 125
debug3: mm_request_receive entering
debug3: Copy environment: XDG_SESSION_ID=2198
Environment:
LANG=en_US.UTF-8
USER=ndejay
LOGNAME=ndejay
HOME=/home/ndejay
PATH=/usr/local/bin:/usr/bin
MAIL=/var/mail/ndejay
SHELL=/bin/bash
...
SSH_TTY=/dev/pts/1
TERM=xterm-256color
XDG_SESSION_ID=2198
Could not chdir to home directory /home/ndejay: Permission denied
/bin/bash: Permission denied
Connection to fs01 closed.

• 服务器端日志的关键片段：

Connection from 172.21.13.11 port 50449 on 172.21.13.10 port 222
...
Could not stat AuthorizedKeysCommand "/usr/bin/sss_ssh_authorizedkeys": Permission denied
...
debug1: Could not open authorized keys '/home/ndejay/.ssh/authorized_keys': Permission denied
...
Accepted password for ndejay from 172.21.13.11 port 51316 ssh2
...
/dev/pts/1: Permission denied
open /dev/tty failed - could not set controlling tty: Permission denied
...
Received disconnect from 172.21.13.11: 11: disconnected by user

再次感谢大家的帮忙！

备注：内容来源于stack exchange，提问作者Nicolas De Jay