Contents
Why does my SSH Tell Me my Password has expired?
The cause of the issue is the order of operations that causes the expired password prompt as explained here: SSH runs the PAM account stage, which verifies that the account exists and is valid. The account stage notices that the password has expired, and lets SSH know. SSH performs key-based authentication.
How to know if SSH authentication is failing?
You need to run ssh (the client, and possibly the server) with more verbosity to understand why authentication is failing. For the client, run On the server end, check the logs. /var/log/auth.log will give you a pretty good idea about what happens when you try to login, look for messages that contain sshd.
Do you need a password for SSH connection?
First of all, if these are servers, you should not have a password at any cost other than the root account with “Break-glass” (last resort) scenario. All connection should only be SSH with keys and no passwords for obvious reasons. I would recommend you have a chat with your Sys Admins about increasing security.
Why are users not prompted to change expired passwords?
Verify your account to enable IT peers to see that you are a professional. This happens to us as well, and it is all based on the time that they previously changed their password at. Users don’t like to change their passwords, so they will always put it off until they’re forced too. Edit: They are, in fact, being reminded.
What happens if my pubkey password expires?
There is a SLES 11 machine. The users logs in via SSH and pubkey (mixed, some user uses password, some use ssh key) The problem: If the password expires for a user that uses pubkey login, then the user will be prompted to change password.
How to ignore an expired password in Pam?
Basically it tells pam_unix to ignore an expired password if something other than pam_unix was used for auth, e.g. if sshd performed the auth. As a result, if you have a version of pam_unix.so that contains that option, you should be able to configure PAM to: Not impact any other auth sequence (e.g. via the login service).