Updated: 28 September 2026 · Applies to: RHEL / CentOS 7 with SSSD
On RHEL/CentOS 7 systems joined to a domain with SSSD, a stale pam_preauth_available file can force pre-authentication prompts. Remove it automatically when SSSD starts.
Steps (root)
- Create a drop-in instead of editing the packaged unit:
systemctl edit sssdand add:[Service] ExecStartPost=/usr/bin/rm -f /var/lib/sss/pubconf/pam_preauth_available
- Reload and restart SSSD:
systemctl daemon-reload systemctl restart sssd
- Check that the file is gone:
ls -l /var/lib/sss/pubconf/pam_preauth_available.
Ucartz services for this topic
- KVM VPS hosting: NVMe SSD and full root access, with Free Basic Managed Support.
- Unmanaged dedicated servers: full root access and free IPMI KVM, with Free Basic Managed Support.
- Linux server management: hardening, patching, monitoring and automation for Ubuntu, Debian, RHEL and AlmaLinux.
