ssh and password expiration notices

[Gary Fitzgerald_1]

Environment:
HP-UX 11.11 with June 2005 Gold patches
HP-UX Secure Shell-A.04.10.002
Trusted Security is enabled.

When I telnet to the server, I get password expiration messages. For example:

telnet myserver
login: testuser
Password:
Last successful login for testuser: Wed Nov 2 18:20:15 EST5EDT 2005 on pts/ta
Last unsuccessful login for testuser: Wed Nov 2 12:14:09 EST5EDT 2005
Your password will expire on Wed Nov 2 21:15:15 EST5EDT 2005
==============================================================
When I use ssh with the following sshd_config configuration options, I don't receive expiration notices:

PasswordAuthentication yes
ChallengeResponseAuthentication no
UsePAM yes

ssh myserver
testuser@myserver's password:
Last login: Wed Nov 2 18:20:31 2005 from myserver
=============================================

PasswordAuthentication no
ChallengeResponseAuthentication yes
UsePAM yes

testuser@myserver's password:
Last login: Wed Nov 2 18:20:31 2005 from myserver
============================================

PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM yes

ssh myserver
Permission denied (publickey)
============================================

PasswordAuthentication no
ChallengeResponseAuthentication yes
UsePAM no

ssh myserver
Permission denied (publickey,keyboard-interactive)
==================================================

If I disable PAM, then I do get a slightly different password expiration notice, but I can't logon to accounts that have passwords greater than 8 characters.

PasswordAuthentication yes
ChallengeResponseAuthentication no
UsePAM no

ssh myserver
Your password will expire in 1 day.
Last login: Wed Nov 2 18:28:45 2005 from myserver
==================================================

So, is there some other configuration scenario that will provide secure shell logins with similar information as telnet?

(As a workaround I'm using a cron script to notify users, as per examples in earlier threads).

[Steven E. Protter]

Apparently the pam configuration can be manipulated to make this work properly.

I'm not going to tell you I understand how to do it, but there may be clues here.

http://lists.samba.org/archive/samba/2001-February/024891.html

SEP

[Gary Fitzgerald_1]

Thanks for the quick response, but I think that's a bit more than I'm prepared to do at this point.

[Ermin Borovac · Accepted solution]

Does it work when privilege separation is turned off?

UsePAM yes
UsePrivilegeSeparation no

[Gary Fitzgerald_1]

Perfect! That's exactly what I was looking for.

[Bill Hassell]

Just a note about the 8 character password problem: Were these passwords created before the system was converted to Trusted? If so, the extra characters were being ignored by the unTrusted system, only the first 8 were used. When the system became Trusted, the passwords are all 8 characters or less, but now if you enter more than 8, the Trusted system verifies all characters and will fail to authenticate. Enter just the first 8 characters and it should work fine. And in Trusted mode, if you change the password to more than 8, all the characters will be used for authentication.

[Gary Fitzgerald_1]

The long passwords were created after system was trusted, so PAM is required. Had a similar issue with sudo which required compiling "--with-pam".

[Gary Fitzgerald_1]

Problem resolved. Thanks.