[Ubuntu] 解决su: authentication failure & 云服务器重启后指纹问题

su: authentication failure

默认 系统 root 登录 图形界面，出现 登录失败。解决方法如下：

1，登录普通用户, 打开终端执行命令, 使用su root或sudo -i切换到root用户(必须)

su root
按照提示输入密码即可切换用户。

若root账户密码忘记，使用如下命令重设后再切换。

sudo passwd root
2，在终端中输入如下命令，打开文件

gedit /etc/pam.d/gdm-autologin
将打开的文件中第三行前加#，如下注释掉语句 “auth required pam_succeed_if.so user != root quiet_success”

#%PAM-1.0
auth    requisite       pam_nologin.so
#auth    required    pam_succeed_if.so user != root quiet_success
auth    optional    pam_gdm.so
auth    optional    pam_gnome_keyring.so
auth    required        pam_permit.so
@include common-account
# SELinux needs to be the first session rule. This ensures that any 
# lingering context has been cleared. Without this it is possible 
# that a module could execute code in the wrong domain.
session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so close
session required        pam_loginuid.so
# SELinux needs to intervene at login time to ensure that the process
# starts in the proper default security context. Only sessions which are
# intended to run in the user's context should be run after this.
session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so open
session optional        pam_keyinit.so force revoke
session required        pam_limits.so
session required        pam_env.so readenv=1
session required        pam_env.so readenv=1 user_readenv=1 envfile=/etc/default/locale
@include common-session
session optional        pam_gnome_keyring.so auto_start
@include common-password

3，保存并退出,继续在终端执行

gedit /etc/pam.d/gdm-password
将打开的文件中第三行语句加#注释掉，如下图

#%PAM-1.0
auth    requisite       pam_nologin.so
#auth    required    pam_succeed_if.so user != root quiet_success
@include common-auth
auth    optional        pam_gnome_keyring.so
@include common-account
# SELinux needs to be the first session rule. This ensures that any 
# lingering context has been cleared. Without this it is possible 
# that a module could execute code in the wrong domain.
session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so close
session required        pam_loginuid.so
# SELinux needs to intervene at login time to ensure that the process
# starts in the proper default security context. Only sessions which are
# intended to run in the user's context should be run after this.
# pam_selinux.so changes the SELinux context of the used TTY and configures
# SELinux in order to transition to the user context with the next execve()
# call.
session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so open
session optional        pam_keyinit.so force revoke
session required        pam_limits.so
session required        pam_env.so readenv=1
session required        pam_env.so readenv=1 user_readenv=1 envfile=/etc/default/locale
@include common-session
session optional        pam_gnome_keyring.so auto_start
@include common-password

4，保存并退出。在终端继续执行

gedit /root/.profile
将打开的文件中“mesg n 2> /dev/null || true” 改为

tty -s&&mesg n 2> /dev/null || true
5，保存并退出。

6，重启，即可以root用户登录。

要在Ubuntu中启用root用户登录SSH：

1. 打开SSH配置文件

首先，我们需要打开SSH配置文件。在终端中输入以下命令：

sudo nano /etc/ssh/sshd_config
这将打开SSH配置文件。

2. 修改配置文件

1）在配置文件中，我们需要找到以下行：

#PermitRootLogin prohibit-password
将其改为：

PermitRootLogin yes
这将允许root用户登录SSH。

2）在配置文件中找到以下行：

UsePAM yes
将其改为：

UsePAM no
这将不启用PAM认证。

3. 重启SSH服务

完成修改后，我们需要重启SSH服务，以使更改生效。在终端中输入以下命令：

sudo service ssh restart
现在，可以使用root用户登录SSH了。

云服务器重启后指纹问题

在 Windows 的命令提示符（cmd）或 PowerShell 中运行：

ssh-keygen -R IP

这个命令会自动从 known_hosts 中删除与该 IP相关的所有记录。

删除旧指纹后，正常的ssh重连操作即可