PowerProtect Data Manager: Cannot Have Access To PowerProtect Data Manager SSH

The PowerProtect Inteface is accessible and functional, but SSH connections to the PowerProtect appliance are refused or authentication fails.

1. GUI‑created user: An administrator attempts to SSH to the PowerProtect appliance using credentials created for the PowerProtect Interface. The SSH connection is rejected because PowerProtect Interface user accounts do not have corresponding OS‑level accounts on the appliance.
2. Admin user locked: The admin SSH account is locked after multiple failed login attempts, or the administrator does not know the current admin SSH password. SSH authentication fails even though the admin account was previously functional.

In both scenarios, the PowerProtect Interface continues to function normally because Interface authentication and SSH authentication use separate user stores.

PowerProtect Data Manager maintains separate user stores for Interface access and SSH access:

• Interface users — Accounts created through the PowerProtect Interface exist only within the PowerProtect application. These accounts authenticate to the PowerProtect Interface but do not have corresponding operating system (OS) accounts on the PowerProtect appliance. Interface created users cannot SSH to the appliance.
• SSH users — SSH access requires an OS‑level account on the PowerProtect appliance. The admin account is the default SSH user created during PowerProtect deployment. Additional SSH users must be created using the useradd command at the OS level.
• Separate passwords — The admin account can have different passwords for SSH and GUI access. Changing the admin password in the PowerProtect Interface does not change the SSH password, and vice versa.

The admin SSH account can become locked after repeated failed login attempts due to the Linux PAM (Pluggable Authentication Module) account lockout policy.

If the admin SSH account is locked or the password is unknown, access the PPDM appliance through the vSphere console as root to unlock and reset the account.

1. Access the PowerProtect appliance console as root:
   • Open the vSphere Client, navigate to the PowerProtect virtual machine, and open the Web Console or Remote Console.
   • Log in as the root user.
   • If the root password is unknown, follow the root password reset procedure documented in Dell KB article: How to reset the root password on PowerProtect Data Manager.
2. Unlock the admin account (if locked):
   • Check whether the admin account is locked and reset the failed login counter:

     pam_tally2 --user=admin --reset

   • This command resets the failed‑attempt counter for the admin account and unlocks it if it was locked due to excessive failed login attempts.
3. Reset the admin SSH password:
   • Set a new password for the admin SSH account:

     passwd admin

   • Enter and confirm the new password when prompted.
   • Note: This command changes the admin SSH password only. It does not change the admin Interface password. The SSH and Interface passwords are managed independently.
4. Verify SSH access:
   • Open a new SSH session to the PowerProtect appliance and log in as admin using the new password.
   • Confirm the login succeeds and the admin account is no longer locked.
   • If SSH access still fails after unlocking the account and resetting the password, contact Dell Support for further investigation and reference this KB article.