Hello Dineshkanna,
yes, this is the behavior on Ubuntu (and on many other Linux distributions): an
expired password will block or interrupt an SSH session even if the user
successfully authenticates using an SSH Public Key.
Thi sis because PAM is used to handle system security and it's done in two
phases, when logging in via ssh:
- auth phase: sshd validates the cryptographic public key; this succeeds
without checking your password
- account phase: sshd hands the session over to PAM to verify account health
via /etc/pam.d/sshd
The PAM module pam_unix.so checks the user's password aging attributes in
/etc/shadow (governed by PASS_MAX_DAYS). If the password is older than allowed,
PAM returns an account expired error.
OpenSSH then forces a password change or rejects the connection.
There are two solutions:
1) <recommended>
If specific non-root users or functional user accounts rely strictly on SSH
keys, disable their password aging entirely and disable expiration for that
specific user:
sudo chage -M -1 <username>
(verify:
sudo chage -l <username>
)
2)
Or configure PAM to bypass expiration for ssh generally (system-wide).
It can be done by opening /etc/pam.d/sshd and commenting out line:
# @include common-account
and by explicitly adding the pam_unix.so module with the no_pass_expiry flag
below it:
account requisite pam_unix.so no_pass_expiry
** Package changed: linux (Ubuntu) => openssh (Ubuntu)
** Changed in: openssh (Ubuntu)
Importance: Undecided => Medium
** Changed in: openssh (Ubuntu)
Status: New => Opinion
** Also affects: ubuntu-z-systems
Importance: Undecided
Status: New
** Changed in: ubuntu-z-systems
Status: New => Opinion
** Changed in: ubuntu-z-systems
Importance: Undecided => Medium
** Changed in: ubuntu-z-systems
Assignee: (unassigned) => Skipper Bug Screeners (skipper-screen-team)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2162945
Title:
[UBUNTU 22.04] Non-root users are prompted to reset their password
after PASS_MAX_DAYS expiry, despite having Public Key Authentication
enabled.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu-z-systems/+bug/2162945/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
