Marc Haber wrote:
Actually, I think that #250369 is an issue with Debian packaging, adding UsePAM unconditionally on update which is not intended on systems that have passwordauthentication=no.
I see. I don't think you need to disable PAM entirely (the account and session modules might still be useful).
What you probably want instead is "ChallengeResponseAuthentication no" in addition to to "PasswordAuthentication no". This will prevent users logging on using their passwords via CR/keyboard-interactive, which appears to be what's happening in your case.
--
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7 8FF4 FA69
Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.