Bug#240506: Debian bug #240506: possible solution
Hi.
With the upstream changes to OpenSSH, in order to actually use PAM for
authentication, you need to enable ChallengeResponseAuthentication, and
you probably should disable PasswordAuthentication.
PasswordAuthentication will work against the contents of /etc/shadow
(actually, whatever getspnam() returns) if UsePAM is enabled. In this
case the authentication is against /etc/shadow, but the PAM account and
session modules are still used.
Debian Maintainer: perhaps the package should warn about this, if it
doesn't already?
--
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.
Reply to: