how to disable pam_ssh

[Rajesh G. Ghone]

Dear All,

Please let me know to how to disable pam_ssh.

Thanks,
Rajesh Ghone.

[Mel Burslan · Accepted solution]

edit /opt/ssh/etc/sshd_config

find line starting with "Use PAM" (capitalization of the letters might be different)

change it to

Use_PAM No

stop and restartd sshd using

/sbin/init.d/secsh stop
/sbin/init.d/secsh start

Hope this helps

[Rajesh G. Ghone]

Thanks Mel it worked for me..

[Steven E. Protter]

Shalom,

You now have instructions on how to do this. But you may end up with no ssh connectivity or a security hole.

Can you explain why you wish to do this?

SEP

[Rajesh G. Ghone]

Hi Sep,

There was a Security Audit and in that audit the auditor found that pam_ssh is enabled and as per there document the pam_ssh should be disable since there is CVE threat in it..

so I have decided to disable the pam_ssh do u see any risk in disabling pam_ssh??

[Steven E. Protter]

Shalom again.

Yes I see a risk.

totally disabling pam_ssh might lead to problems.

The entire point of a pam_ssh configuration is to insure that authentication of ssh follows some logical pattern.

Commenting it out might be a bigger problem.

Security auditors are a strange bunch. They need to find stuff in order to justify their existence.

In this case, I'd need to see why they think this is a problem. I would not do this without a good reason.

SEP

[Steven E. Protter]

Sorry. I am using a laptop and was not done.

They may have a problem with your pam_ssh configuration. I find it difficult to believe that they would want you to just comment it out.

They may want a stronger configuration, which they should recommend.

SEP