Root problems

[foglertech]

Months back I disabled the root account on my cluster. Now I'd like to add another node to my cluster, but it requires root's password. After enabling root again, I am unable to log in via the web GUI with root@pam. All other logins work fine. I can SSH just fine with root@pam as well. Attempting to add any new nodes via CLI also fails due to an authentication error.

journalctl -xe shows a authentication failure; rhost=REDACTED user=root@pam msg=missing required 2nd keys

I created some new keys and added them to roots@pam authorized_keys, but I still get the error.

Anybody have any suggestions on what other things to check, or potential fixes? Thanks.

 

[foglertech]

Aaaaaaaand I figured it out. At some point, I must've set PAM to use TFA (despite not actually setting TFA up). Changing the PAM domain's "Require TFA:" to NONE resolved the issue. Now to set it up TFA correctly...... Screenshots for reference.

 

[sb-jw]

It is not recommended to deactivate the root user. In some cases the user is also hardcoded in PVE.

 

[foglertech]

@sb-jw I have come to realize this!