topic Re: Firewall SSH, the login succeeds with TACACS Account, but there is an issue that closes the session immediately. in Next-Generation Firewall Discussions

Firewall SSH, the login succeeds with TACACS Account, but there is an issue that closes the session immediately.

hbshin — Fri, 03 May 2024 01:04:03 GMT

Hello, everyone.

Firewall has OS of 10.2.4-H2.

When TACACS account to connect to Firewall SSH, the login succeeds, but there is an issue that closes the session immediately.

In Firewall System-log, authentication and authorization were successful and it was confirmed that the Superuser role was granted..

However, a "create-admin-acct-error" log with Critical Severity is created. - "Failed to create local user account for admin user: username" in system-log.

WEB GUI is connected normally, but only SSH Session issues.

the log was generated as below in TSF File syslog-system.

sshd[13371]: error: PAM: User account has expired for [username] from [IP].

HA Peer device doesn't have this issue at all. It happens only on this firewall.

Is there any way to solve?

Re: Firewall SSH, the login succeeds with TACACS Account, but there is an issue that closes the session immediately.

J.Klasa — Mon, 13 Apr 2026 20:24:51 GMT

You can try these commands if you haven't already solved I guess since it's an old post but I hade the exact same issue.

> Remove Lock Files: delete authentication system-lock-files
> Restart the Authentication Daemon: debug software restart process authd

Re: Firewall SSH, the login succeeds with TACACS Account, but there is an issue that closes the session immediately.

abayoumi21 — Thu, 16 Apr 2026 11:00:24 GMT

Check the local admin account as it seems flaged as expired, additionally, you can clear cache by command "debug authentication clear-cache all".

Finally if the issue not resolved, you can try restart the management plane "debug software restart process management-server".

On the other hand, could check you panos release as some of them has a known bug in TACACS authentication.

Re: Firewall SSH, the login succeeds with TACACS Account, but there is an issue that closes the session immediately.

J.Klasa — Mon, 20 Apr 2026 06:23:05 GMT

I created a TAC case and these commands solved it and they came from TAC engineer.