[Pam-developers] Re: Add option to ignore password expiration in pam_unix

On St, 2016-01-27 at 11:14 +0100, Thorsten Kukuk wrote: > Hi, > > On Tue, Jan 26, Tomas Mraz wrote: > >> Hello, >> >> OpenSSH sshd calls (correctly) pam_acct_mgmt even for >> authentication >> methods that do not involve user passwords. The attached patch >> allows >> pam_unix to optionally ignore the password expiration. What do you >> think about it? Would it be OK to commit if I provide also >> documentation of the no_pass_expiry option? > > I have no problem with the patch, but I think if the password > expiration should be ignored, they should not set it, openssh > should not call it or the admin should not configure it ... > They might use both password authentication - for console login for example - and public key auth. In my opinion the most correct place to fix this is openssh - it should ignore these return values from pam_acct_mgmt if pam_authenticate() call is not the source of the successful authentication. I will try to push the change this way.