Firewall SSH, the login succeeds with TACACS Account, but there is an issue that closes the session immediately.

[hbshin]

Hello, everyone.

Firewall has OS of 10.2.4-H2.

When TACACS account to connect to Firewall SSH, the login succeeds, but there is an issue that closes the session immediately.

In Firewall System-log, authentication and authorization were successful and it was confirmed that the Superuser role was granted..

However, a "create-admin-acct-error" log with Critical Severity is created. - "Failed to create local user account for admin user: username" in system-log.

WEB GUI is connected normally, but only SSH Session issues.

the log was generated as below in TSF File syslog-system.

sshd[13371]: error: PAM: User account has expired for [username] from [IP].

HA Peer device doesn't have this issue at all. It happens only on this firewall.

Is there any way to solve?

[J.Klasa]

You can try these commands if you haven't already solved I guess since it's an old post but I hade the exact same issue. 

> Remove Lock Files: delete authentication system-lock-files
> Restart the Authentication Daemon: debug software restart process authd

[abayoumi21]

Check the local admin account as it seems flaged as expired, additionally, you can clear cache by command "debug authentication clear-cache all".

Finally if the issue not resolved, you can try restart the management plane "debug software restart process management-server".

On the other hand, could check you panos release as some of them has a known bug in TACACS authentication.

[J.Klasa]

I created a TAC case and these commands solved it and they came from TAC engineer.