Re: [gentoo-security] pam configuration for ssh

[Adrian CAPDEFIER]

Paul de Vrieze wrote:
> On Tuesday 10 August 2004 08:50, Adrian CAPDEFIER wrote:
>
>>Hello.
>>I'm trying to have my sshd use only key-based auth while still taking
>>advantages of the PAM modules.
>>My sshd_config is config quite right but pam modules overwrite some of
>>those settings that deny password login. How should I modify this file
>>
>>neuro root # cat /etc/pam.d/sshd
>>
>>auth     required pam_unix.so nullok
>>auth     required pam_shells.so
>>auth     required pam_nologin.so
>>auth     required pam_env.so
>>account  required pam_unix.so
>>password required pam_cracklib.so difok=3 retry=3 minlen=8 \
>>			dcredit=2 ocredit=2 use_authtok
>>password required pam_unix.so shadow md5
>>session  required pam_unix.so
>>session  required pam_limits.so
>>
>>I've shamelessy copied this from the gentoo security guide and, as it
>>was my understanding, it was supposed to deny password logins. Well it
>>doesn't. When I disable PAM in /etc/ssh/sshd_config, passwords are
>>disabled but as I said before I want to use PAM.
>>Some recommended reading on PAM would be nice, too :).
>
>
> What about just using:
> auth	required pam_deny and nothing else for the auth service
>
> Paul
>
> ps. the password service should not be needed by ssh (it doesn't set
> passwords), so make it deny too.
>

Thank you, Paul! You helped me again :). That did the trick with 
password logins.
I don't understand the p.s. though.
Who sets the passwords when remotely logged in?
I set password only to pam_deny.so and i was still able to change those 
passwords so now my file looks like this (comments excluded)

neuro root # cat /etc/pam.d/sshd

auth     required pam_deny.so
account  required pam_unix.so
password required pam_deny.so
session  required pam_unix.so
session  required pam_limits.so


-- 

Adi

--
gentoo-security@g.o mailing list