Bug 2228934

Description of problem:

Using "pam_access", ssh login failed with below entry in /etc/security/access.conf:
-------
+:username:localhost server1.example.com
-------

Version-Release number of selected component (if applicable):


How reproducible:

Steps to Reproduce:

1. On RHEL8.8 machine, enable "with-pamaccess" feature using authselect:
~~~~~
# authselect enable-feature with-pamaccess
~~~~~

2. Then configure  /etc/security/access.conf as below:
-------
+:username:localhost server1.example.com
-------

3. Try to login with the user .
~~~~
# ssh username@localhost

# ssh username.com
~~~~

4. It only works when below /etc/security/access.conf file configured as below:
-------
+:username:127.0.0.1 ::1 x.x.x.x
-------

*Actual IP-address is replaced with x.x.x.x

Actual results:

Login failed, as access denied in the account section.

Expected results:

Successful login using "pam_access". ssh login should work with below entry in /etc/security/access.conf:
-------
+:username:localhost server1.example.com
-------


Additional info:

Reproduced as below on test-box:

[root@rhds12 ~]# cat /etc/redhat-release 
Red Hat Enterprise Linux release 8.8 (Ootpa)

[root@rhds12 ~]# id test21
uid=1007(test21) gid=1007(test21) groups=1007(test21)


[root@rhds12 ~]# cat  /etc/security/access.conf  | grep -v -e "^#"
+:root:ALL
+ : test19 : ALL
+:test21:localhost
-:ALL:ALL

[root@rhds12 ~]# hostname
rhds12.example.com

[root@rhds12 ~]# authselect current
Profile ID: sssd
Enabled features:
- with-mkhomedir
- with-pwhistory
- with-faillock
- with-pamaccess


[root@rhds12 ~]# cat /etc/hosts
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6

x.x.x.x rhds12.example.com


=====================
[root@rhds12 ~]# ssh test21@localhost
test21@localhost's password: 
Connection closed by ::1 port 22

--------
[root@rhds12 ~]# tail -n 6 /var/log/secure
Aug  3 12:12:52 rhds12 sshd[2076290]: pam_access(sshd:account): access denied for user `test21' from `::1'
Aug  3 12:12:52 rhds12 sshd[2076290]: Failed password for test21 from ::1 port 50230 ssh2
Aug  3 12:12:52 rhds12 sshd[2076290]: fatal: Access denied for user test21 by PAM account configuration [preauth]
Aug  3 12:13:45 rhds12 sshd[2076360]: pam_access(sshd:account): access denied for user `test21' from `::1'
Aug  3 12:13:45 rhds12 sshd[2076360]: Failed password for test21 from ::1 port 56414 ssh2
Aug  3 12:13:45 rhds12 sshd[2076360]: fatal: Access denied for user test21 by PAM account configuration [preauth]
-------


- Now, replaced localhost with 127.0.0.1
----------
[root@rhds12 ~]# cat  /etc/security/access.conf  | grep -v -e "^#" | grep test21
+:test21:127.0.0.1
----------

- But still failed to login with localhost:
-----------------
[root@rhds12 ~]# ssh test21@localhost
test21@localhost's password: 
Connection closed by ::1 port 22
-----------------

-------
[root@rhds12 ~]# tail -n 3 /var/log/secure
Aug  3 12:17:15 rhds12 sshd[2076613]: pam_access(sshd:account): access denied for user `test21' from `::1'
Aug  3 12:17:15 rhds12 sshd[2076613]: Failed password for test21 from ::1 port 36390 ssh2
Aug  3 12:17:15 rhds12 sshd[2076613]: fatal: Access denied for user test21 by PAM account configuration [preauth]
-------


- Now added ::1 (i.e IPv6 loopback) in /etc/security/access.conf:
------
[root@rhds12 ~]# cat  /etc/security/access.conf  | grep -v -e "^#" | grep test21
+:test21:127.0.0.1 ::1
------

- Tried to login and it worked fine:
------------
[root@rhds12 ~]# ssh test21@localhost
test21@localhost's password: 

There were 3 failed login attempts since the last successful login.
[test21@rhds12 ~]$ 
-------------
=======================


- Now added hostname of the machine, so that it can be accessed with hostname:
--------
[root@rhds12 ~]# cat  /etc/security/access.conf  | grep -v -e "^#" | grep test21
+:test21:127.0.0.1 ::1 rhds12.example.com
--------

- But login failed:
-------
[root@rhds12 ~]# ssh test21.com
test21.com's password: 
Connection closed by x.x.x.x port 22
-------

------
Aug  3 12:24:39 rhds12 sshd[2077143]: pam_access(sshd:account): access denied for user `test21' from `x.x.x.x'
------


- Now added IP-address instead of hostname:
---------
[root@rhds12 ~]# cat  /etc/security/access.conf  | grep -v -e "^#" | grep test21
+:test21:127.0.0.1 ::1 x.x.x.x
---------

- Tried to login and it worked fine when logged in with hostname:
--------
[root@rhds12 ~]# ssh test21.com
test21.com's password: 

There were 2 failed login attempts since the last successful login.
Last login: Thu Aug  3 12:20:06 2023 from ::1
[test21@rhds12 ~]$ 
---------
=============================