problems with PasswordAuthDenyUsers in sshd

[Adam Scheblein]

Greetings,

Currently i am trying to restrict some of our users to public key only however when i put someone in the list for PasswordAuthDenyUsers ex:

PasswordAuthDenyUsers adam

I am still able to login using my password after a restart of ssh.

any help is appreciated.

thanks,
Adam

[Peter Godron]

Adam,
shouldn't that be the PubKeyAuthAllowUsers directive ?

See:
http://docs.hp.com/en/T1471-90019/ch01s02.html

[Adam Scheblein]

From what i have read, the PubKeyAuthAllowUsers unless specified otherwise is * (all users). All i am trying to do is disable password login for a couple users.

[Santhi · Accepted solution]

Hi Adam,

In HP-UX SSH, PAM is enabled by default. Since ur are logged in using ur password after setting the PasswordAuthDenyUsers adam. To deny pam password also,
run the server without PAM.

/opt/ssh/sbin/sshd -o "UsePAM no" -o "PasswordAuthDenyUsers adam"

Otherwise set the following directive in sshd_config file or commandline as follows:

/opt/ssh/sbin/sshd -o "PasswordAuthDenyUsers adam" -o " ChallRespAuthDenyUsers [pam] adam"

These methods can deny the password authentication for a specific user.

Thanks,
Santhi.

[Adam Scheblein]

thanks for all the help!! the last suggestion worked -- i didn't realize that pam was enabled on HP-UX by default :)