[gentoo-security] pam configuration for ssh

[Adrian CAPDEFIER]

Hello.
I'm trying to have my sshd use only key-based auth while still taking 
advantages of the PAM modules.
My sshd_config is config quite right but pam modules overwrite some of 
those settings that deny password login. How should I modify this file

neuro root # cat /etc/pam.d/sshd

auth     required pam_unix.so nullok
auth     required pam_shells.so
auth     required pam_nologin.so
auth     required pam_env.so
account  required pam_unix.so
password required pam_cracklib.so difok=3 retry=3 minlen=8 \
			dcredit=2 ocredit=2 use_authtok
password required pam_unix.so shadow md5
session  required pam_unix.so
session  required pam_limits.so

I've shamelessy copied this from the gentoo security guide and, as it 
was my understanding, it was supposed to deny password logins. Well it 
doesn't. When I disable PAM in /etc/ssh/sshd_config, passwords are 
disabled but as I said before I want to use PAM.
Some recommended reading on PAM would be nice, too :).

-- 

Adi

--
gentoo-security@g.o mailing list