I upgraded a computer from Fedora 41 to Fedora 42 using dnf. After the upgrade, I found that I could no longer SSH to the computer. I see this on the client:

$ ssh USER@HOSTNAME
USER@HOSTNAME's password: [Enter password]
Connection closed by HOSTNAME port 22

I found this in the server's system logs:

May 14 09:09:03 HOSTNAME sshd-session[6113]: pam_access(sshd:account): access denied for user `USER' from `IPADDR'
May 14 09:09:03 HOSTNAME sshd-session[6113]: pam_sss(sshd:account): Access denied for user USER: 10 (User not known to the underlying authentication module)
May 14 09:09:03 HOSTNAME audit[6113]: USER_ACCT pid=6113 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=? acct="USER" exe="/usr/libexec/openssh/sshd-session" hostname=IPADDR addr=IPADDR terminal=ssh res=failed'
May 14 09:09:03 HOSTNAME sshd-session[6113]: fatal: Access denied for user USER by PAM account configuration [preauth]

My PAM configuration uses pam_access to restrict access. My /etc/pam.d/system-auth follows:

# Generated by authselect
# Do not modify this file manually, use authselect instead. Any user changes will be overwritten.
# You can stop authselect from managing your configuration by calling 'authselect opt-out'.
# See authselect(8) for more details.

auth        required                                     pam_env.so
auth        required                                     pam_faildelay.so delay=2000000
auth        [default=1 ignore=ignore success=ok]         pam_usertype.so isregular
auth        [default=1 ignore=ignore success=ok]         pam_localuser.so
auth        sufficient                                   pam_unix.so nullok
auth        [default=1 ignore=ignore success=ok]         pam_usertype.so isregular
auth        sufficient                                   pam_sss.so forward_pass
auth        required                                     pam_deny.so

account     required                                     pam_access.so
account     required                                     pam_unix.so
account     sufficient                                   pam_localuser.so
account     sufficient                                   pam_usertype.so issystem
account     [default=bad success=ok user_unknown=ignore] pam_sss.so
account     required                                     pam_permit.so

password    requisite                                    pam_pwquality.so local_users_only
password    sufficient                                   pam_unix.so yescrypt shadow nullok use_authtok
password    [success=1 default=ignore]                   pam_localuser.so
password    sufficient                                   pam_sss.so use_authtok
password    required                                     pam_deny.so

session     optional                                     pam_keyinit.so revoke
session     required                                     pam_limits.so
-session    optional                                     pam_systemd.so
session     [success=1 default=ignore]                   pam_succeed_if.so service in crond quiet use_uid
session     required                                     pam_unix.so
session     optional                                     pam_sss.so

Here is my /etc/security/access.conf:

-:ALL EXCEPT root (wheel) (students) (faculty):ALL EXCEPT LOCAL

Reproducible: Always

Steps to Reproduce:
Try to SSH to the computer running Fedora 42 and configured to use pam_access as indicated above. I have tried to login using a local account in the wheel group and an LDAP account in the faculty group.
Actual Results:
See details section above.

Expected Results:
The host should allow authenticated SSH connections.

Additional Information:
I am able to list LDAP accounts using "getent passwd" and "getent group", so sssd seems properly configured. I have confirmed the accounts are members of the relevant groups using the "groups" command. I am able to login using a local console.

Downgrading to the latest Fedora 41 pam and pam-libs packages fixes the problem (pam-1.6.1-7.fc41.x86_64.rpm and pam-libs-1.6.1-7.fc41.x86_64.rpm). SSH allows logins after I do that.