Updated: 28 September 2026 · Applies to: RHEL / CentOS 7 with SSSD
On RHEL/CentOS 7 systems joined to a domain with SSSD, a stale pam_preauth_available file can force pre-authentication prompts. Remove it automatically when SSSD starts.
Steps (root)
- Create a drop-in instead of editing the packaged unit:
systemctl edit sssdand add:[Service] ExecStartPost=/usr/bin/rm -f /var/lib/sss/pubconf/pam_preauth_available
- Reload and restart SSSD:
systemctl daemon-reload systemctl restart sssd
- Check that the file is gone:
ls -l /var/lib/sss/pubconf/pam_preauth_available.
