#219377 - sshd: Ignores Pam Lockout When using SSH PubKey Auth http://bugs.debian.org./219377 This problem seems to be resolved by an upload of shadow last year (see #402329). passwd -l should now effect a fully locked account. Could you test that this works as needed?