Log Dejargonizer

Linux PAM · Event pam_unix authentication failure

pam_unix authentication failure: a login was rejected

The PAM authentication layer refused a login. Because nearly every Linux login path goes through PAM, these messages cover SSH, sudo, su, console logins, and services alike — and the service name in brackets tells you which.

Also written as pam_unix authentication failurecheck pass; user unknownpam authentication failure log

What it means for you

On a personal computer

A password was rejected. The text in brackets says which part of the system asked for it.

For an analyst

The service name in brackets — sshd, sudo, login, cron — is the field that gives the message meaning, and it is easy to miss. 'check pass; user unknown' distinguishes a non-existent account from a wrong password, which is the same distinction the Windows sub-status codes make.

What it looks like

Sanitised. Addresses come from the RFC 5737 documentation ranges.

Sample
Aug 28 09:41:15 web-01 sshd[24817]: pam_unix(sshd:auth): check pass; user unknown
Aug 28 09:41:15 web-01 sshd[24817]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=198.51.100.77
Aug 28 09:46:31 web-01 sudo: pam_unix(sudo:auth): authentication failure; logname=jbrooks uid=1000 euid=0 tty=/dev/pts/1 ruser=jbrooks rhost=  user=jbrooks

The fields that decide it

Everything else in the log line is context.

Service in brackets
Which service requested authentication. This determines what the failure means.
  • sshdA remote login attempt.
  • sudoA privilege escalation attempt.
  • loginA console or terminal login.
  • cronA scheduled job failing to authenticate, usually a configuration problem rather than an attack.
logname
The account already signed in, where there was one.
uid / euid
The numeric user and effective user IDs involved.
rhost
The remote host the attempt came from. Empty for local attempts.
user
The account being authenticated.
check pass; user unknown
A separate line indicating the account does not exist, as opposed to the password being wrong.

Ordinary reasons this happens

Most of the time it is one of these.

  • A mistyped password anywhere on the system.
  • An expired password not yet changed.
  • A cron job or service with an outdated credential.
  • A locked account still being used by automation.
  • Internet scanning against exposed SSH, which produces these in bulk.

When it is not ordinary

Credential guessing against any exposed service.

What gives it awayHigh volume from one rhost, particularly with 'user unknown' lines interleaved.

ATT&CK T1110

Account enumeration.

What gives it awayA run of 'check pass; user unknown' entries, which reveal which accounts exist.

ATT&CK T1589.002

Privilege escalation attempts from a compromised account.

What gives it awaysudo-context failures from an account shortly after an unusual login.

ATT&CK T1548.003

What to do next

  1. Read the service name in brackets first. It determines everything else.
  2. Check for a nearby 'user unknown' line, which distinguishes a bad account from a bad password.
  3. Read rhost. An empty value means the attempt was local.
  4. Count attempts per source and per account.
  5. For cron and service contexts, treat it as a configuration problem rather than an attack.
  6. Look for a matching success afterwards from the same source.

Queries to run

grep Sources of authentication failure across every PAM-backed service. 
grep 'pam_unix' /var/log/auth.log | grep 'authentication failure' | grep -oP 'rhost=\K\S*' | sort | uniq -c | sort -rn | head -20
grep Which services are producing PAM failures, which is usually the first thing worth knowing. 
grep -oP 'pam_unix\(\K[^:]+' /var/log/auth.log | sort | uniq -c | sort -rn
splunk 
index=linux sourcetype=linux_secure "pam_unix" "authentication failure" | rex "pam_unix\((?<service>[^:]+):" | stats count by service user rhost | sort -count

Common questions

What does pam_unix authentication failure mean?

PAM, the layer nearly every Linux login goes through, rejected a set of credentials. The service name in brackets tells you where — sshd for remote logins, sudo for escalation, login for console access, cron for scheduled jobs. Without reading that part, the message tells you very little.

What is the difference between 'authentication failure' and 'check pass; user unknown'?

'check pass; user unknown' means no such account exists. 'authentication failure' on its own means the account exists and the password was wrong. When both appear together the account does not exist — the same distinction the Windows sub-status codes make, and it matters for the same reason.

Why does rhost appear empty in some PAM failures?

Because the attempt was local rather than over the network — a console login, a sudo attempt, or a cron job. A populated rhost means the attempt came from another machine, which is the case worth aggregating on.

Read next

Mentioned by

Vendor documentation

Last reviewed 28 August 2026