Description

It was not possible to connect to the backup RE when logged in with a TACACS+ user account.
The system asks for a password. The /var/log/messages shows that the backup routing engine cannot communicate with the TACACS+ server.

Symptoms

Example WITH TACACS+ ACCOUNT
=========================
{master}
user@router-re0> request routing-engine login other-routing-engine
Dec 08 11:55:21
Password: <<<<<< ??
Password:
Password:

{master}
user@router-re0>



Dec 8 11:55:31.247 router re1-sshd[19053]: pam_unix(sshd:auth): check pass; user unknown
Dec 8 11:55:31.248 router re1-sshd[19053]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=128.0.0.4
Dec 8 11:55:31.248 router re1-sshd[19053]: pam_unix(sshd:auth): check pass; user unknown
Dec 8 11:55:33.218 router re1-sshd[19051]: error: PAM: Authentication failure for user from 128.0.0.4
Dec 8 11:55:33.219 router re1-sshd[19051]: notice: Login failed for user 'user' from host '128.0.0.4' [preauth]
Dec 8 11:55:37.225 router re1-sshd[19365]: PAM_TACPLUS_SEND_AUTHEN_FAIL: Failed in sending authentication with error connect: timed out.
 

Solution

This issue is fixed in the Junos Releases listed in PR1759994

On all Junos OS Evolved platforms, inter RE Communication is not working as the "ssh-internal" service is strictly looking for the remote user (configured on Tacplus/Radius server), which is not configured on the device halting the key-based password-less login. This issue happens when login as Tacplus/Radius user and trying to login the other RE, halting the inter RE communication.

Modification History

2024-09-05: Modified solution seciton and making KB public
2023-12-15 : Article Created