[SSSD-users] Re: sshkey use allows expired account user to access system

On 6/2/22 13:36, Jim Kinney wrote:

It seems if valid ssh keys exist, the expired account status doesn't block login with ssh keys.

I believe that's because *users* don't expire.  *Passwords* do. If you aren't authenticating with passwords, then password expiration doesn't affect the account.

This is one of the reasons that users should consider using Kerberos, or SSH certificate systems, rather than SSH keys.

https://smallstep.com/blog/use-ssh-certificates/