ssh logins to disabled users

[Ing Meloni]

I use OpenSSH on my servers.
I noticed people can login with ssh even if their accounts have been disabled.
I just installed the latest version (v. 2.9p2) with no improvements.
There is a way to avoid this?

Thanks

Claudio Arlandini

[harry d brown jr]

To disable an account, change the password field in the /etc/passwd file to an asterisk '*' and change the login shell to /bin/false.

[Ing Meloni]

It sure works this way, but it is not really manageable in my case. I have more or less 300 active users on the system.
By the way, how can I receive a notification
when one of my users is disabled for
password expiring, or too many unsuccessful login attempts?

[harry d brown jr]

I don't think OpenSSH uses much of the default login info.

Check this link out:

http://www.sunmanagers.org/pipermail/summaries/2001-March/000293.html

[Bill Thorsteinson]

Check for a UseLogin option in the sshd.conf file.
If it is turned of login has no chance to check for
disabled logins.

If login doen't catch the disabled accounts, you
may be able to check in the profile script.

[James Beamish-White]

You could script the change of a shell to /bin/false. e.g.
#!/bin/sh
# lockuser.sh

passwd -s /bin/false $1 # Changes shell
passwd -l $1 # Locks account

[Patrick Wirth]

I'm in the process of trying to compile openssh on my servers. Although not yet successful, I seem to have seen some information or flags that have to do with PAM modules and making openssh PAM aware. There might be something related to this that will do what you want.