When you try to log in to the CVM via VNC, the following message appears even you enter the correct password. Later, you are required to enter the account name again.
And when you try to log in remotely using the SSH key, the message Permission denied, please try again appears.
Common Cause
The /var/log/btmp log file is oversized due to brute force attacks. This file keeps logs of failed logins. If it is too large, logs can not be written into it, which may cause login error.
Solutions
1. Check whether the /var/log/btmp log file is oversized as instructed in Troubleshooting Procedure.
2. Confirm whether it is caused by brute force attacks and improve security policy.
2. Access /var/log and check the size of the /var/log/btmp log file.
3. Run the following command to clear the oversized /var/log/btmp log file. Then you can log in normally.
cat /dev/null > /var/log/btmp
4. Check whether the account lock is caused by misoperations or brute force attacks. In the later case, it is recommended to strengthen the security policy as follows:
Change the CVM password to a stronger password containing 12-16 characters, including uppercase letters, lowercase letters, special characters, and numbers. For more information, see Resetting Instance Password.
Manage the associated security group rules to open only ports and protocols required by your business. For more information, see Adding Security Group Rules.
Close the port for internet access for core applications such as MySQL and Redis databases.
Install security software (such as CWPP agent), and configure real-time alarms to get noticed about suspicious logins instantly.
