pam kerberos and ssh PubkeyAuthentication

[Denver Osborn]

I'm setting up a trusted system's pam.conf to use kerberos and the sshd_config for PAM. Problem I'm having is with ssh public-key auth. When the unix account is locked I can still get in using my public-key.

My sshd_config contains:
PasswordAuthentication no
PubkeyAuthentication yes
KerberosAuthentication no

My pam.conf is setup like so...
----
other auth required libpam_updbe.1 debug
other auth sufficient libpam_krb5.1 debug krb_prompt
other auth sufficient libpam_unix.1 debug try_first_pass

other account required libpam_updbe.1 debug
other account sufficient libpam_krb5.1 debug
other account required libpam_unix.1 debug

other session required libpam_updbe.1 debug
other session required libpam_krb5.1 debug
other session required libpam_unix.1 debug

other password required libpam_updbe.1 debug
other password sufficient libpam_krb5.1 debug krb_prompt ignore
other password required libpam_unix.1 debug try_first_pass

----

Any thoughts on what I'm missing? I saw a similar known problem that suggested using PAM_AUTHZ, but it was for PAM_LDAP...

Thanks!
-denver

[Christian Tremblay]

It's a known thing that ssh key authentication will let you login into a locked account.

I don't know if there is a way to disable that "feature"

Chris

[Evert Ladrak]

Denver,

I've never done this but I think you have to tell sshd that you want to use PAM rather then the plain passwd file.

ssh_config(5)
UsePAM 1

-ETL