ssh and password aging

[Lukas Grijander]

Hi all.

When a password expires ..

and the user connects via telnet, after giving the password to the system, it's showed the msg :

Your password has expired. Choose a new one
Changing password for xxxxxx

but if the user connects via ssh, it seems that password never expires ... (Is login running ??)

Can ssh work as telnet, and cause password changing ?

Thanks and best regards.

[Ricardo Bassoi]

Hi Rafael

Yep. And I can say that ssh is broken. All you can do is to force ssh to exec /bin/passwd when password expires.

Other solution is to apply these two patches to ssh 1.2.27, ssh-pam_env+expire.patch first
and then ssh-forced.patch. They add ability to understand PAM_NEW_AUTHTOK_REQD to ssh, and to execute normal passwd by user.
If you prefer openssh then at ftp://ftp.pld.org.pl/stable/SRPMS/ you
can find working src rpm.
Regds,

Bassoi

[Craig Rants · Accepted solution]

Ssh needs to be compiled with the pam option to work with password aging i.e...

- Compile openssh
cd /tmp
gzip -d < openssh-3.1p1.tar.gz | tar xvf -
cd openssh-3.1p1
(11 version)
./configure --prefix=/opt/openssh2 --sysconfdir=/opt/openssh2/etc --with-pam
--with-ssl-dir=/usr/local/openssl/lib --with-default-path=/bin:/usr/bin:/opt/openssh2/bin
(10 version)
./configure --prefix=/opt/openssh2 --sysconfdir=/opt/openssh2/etc
--with-ssl-dir=/usr/local/ssl/lib --with-default-path=/bin:/usr/bin:/opt/openssh2/bin
make
make install

There are a lot of problems that need to be over come from the depot format..
GL,
C

[Donny Jekels]

hey, you'd probibly fixed this by now.

but whta they should have told you then was

to enable login.

UseLogin = yes

in sshd_config

peace
Donny