SSH, PAM and locked accounts

[Thierry Hugue]

Hello,
For several security programs reasons, I need to "lock" accounts via a "*" in the password field.
It works fine for login (telnet refused => good)

Meanwhile, I need to grant SSH access to those accounts (via RSA authentication).
The problem is there : PAM refuses to give a login session, as you can see in the error message below :
PAM rejected by account configuration[17]: User account has expired

How can I setup PAM to accept this kind of accounts ?

Thanks for your help,

[Steven E. Protter]

If you use passwd -l to lock the account you will get the refusal with no login attempt, just a message.

If however you use passwd -f, I think sshd will pick that up and force the user to change the password with the old password. If the user doesn't know what the old password is, the goal is achieved. If I understand the goal.

SEP

[Thierry Hugue]

My objective is to prevent telnet access on those accounts, with a "*" in the password field (no access, no aging), and to allow SSH access via RSA authentication only.

External tools force me to lock accounts by entering a "*" in the password field

And... ssh access does not work in this case, because ssh authentication is delegated to PAM (once SSH stuff is OK), where SSH authentication is based on the same mechanism as telnet (which prevent access if account is locked by "*")

Any suggestion to achieve my objective ?
Thanks,

[Jannik]

you could close the telnet connection possiblility by adding to /var/adm/inetd.sec and then do a passwd -f on the user the the user would only be abel to login though ssh.
If the external program you are talking about is the one doing '*' thing. Then you could just make a script to overright some were along the line :-).

[Jannik]

An alternative is to install TCP-Wrappers: http://hpux.connect.org.uk/hppd/hpux/Networking/Admin/tcp_wrappers-7.6/ This will allow you to restrict access at a very detailed level.
TCP Wrappers will allow you to select which users and/or systems can access the inetd services like "login", "rlogin", "remsh", etc.

[Thierry Hugue]

Unfortunaly, I would have appreciated this kind of solution. But I must get a "*" in the password field, because of... security tools which are checking that (and I cannot change them !)... :-(

So I really need to find a way to get it work with SSH.

Note that I tried to lock the account with something like "AAA" in the password field, and everything is fine (telnet is out, SSH is OK). But I cannot leave this solution (because of other so-called "security" tools...:-(

=> so my question:
how can I get PAM authentication to accept access on locked account, once SSH authentication is OK ?

[Gram Ludlow]

I m in exactly the same boat! I want to have a * in the password field, but still allow SSH to log in. I've been playing with the pam.conf, but that doesn't seemto do much for SSH.