[nycbug-talk] ssh and pam

[Edward Capriolo]

You should look in:

cat /etc/pam.d/sshd
#%PAM-1.0
auth required pam_sepermit.so
auth include password-auth
account required pam_nologin.so
account include password-auth
password include password-auth
# pam_selinux.so close should be the first session rule
session required pam_selinux.so close
session required pam_loginuid.so
# pam_selinux.so open should only be followed by sessions to be executed in
the user context
session required pam_selinux.so open env_params
session optional pam_keyinit.so force revoke
session include password-auth

See the sections on auth_include passwd-auth

be super careful how pam evaluates the modules is very complex.


On Mon, Oct 21, 2013 at 4:23 PM, Mark Saad <mark.saad at ymail.com> wrote:

> Hi talk
>   Its monday and I have forgotten how to make this magic happen . How do I
> tell pam.d/sshd that "you can never use a password"  ?  I have tried
> "PasswordAuthentication no" in sshd_config but its not working.
>
> What I am trying to do , is to have users and groups out of ldap, public
> keys in $HOME, pam_ssh to make sure you have a working agent that is loaded
> with a passphrase protected key and for the server to never prompt you for
> a password  (In the event of the agent not running or ldap being
> unreachable ) I don't want to see a password prompt from either ldap or
> pam_ssh .
>
> Any ideas ?
>
> --
>
> Mark Saad | mark.saad at ymail.com
>
> _______________________________________________
> talk mailing list
> talk at lists.nycbug.org
> http://www.nycbug.org/mailman/listinfo/talk
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.nycbug.org:8443/pipermail/talk/attachments/20131021/3fb00d90/attachment.htm>