There is a SLES 11 machine. The users logs in via SSH and pubkey (mixed, some user uses password, some use ssh key)
The sshd_config has:
UsePAM yes PasswordAuthentication yes PubkeyAuthentication yes
The problem: If the password expires for a user that uses pubkey login, then the user will be prompted to change password.
The question: How can we set the PAM or sshd config to allow users to log in if they have a valid SSH key and they're password expired? - Without popping up "change your password".
UPDATE#1: The solution can't be: "UsePAM no"
SERVER:~ # cat /etc/pam.d/sshd #%PAM-1.0 auth requisite pam_nologin.so auth include common-auth account requisite pam_nologin.so account include common-account password include common-password session required pam_loginuid.so session include common-session SERVER:~ #
UPDATE#2: The solution can't be: set the users password to never expire
SERVER:/etc/pam.d # cat common-account #%PAM-1.0 ... account required pam_unix2.so account required pam_tally.so SERVER:/etc/pam.d #