This question already has an answer here:

Good Morning ,

Why can I still authenticate with a public key via ssh while my account is disabled on active directory?

My infrastructure is CentOS and authentication by active directory with winbind and pam.

Is it a hole of security of winbind and pam ? Do you know a solution for this problem ?

Thank's a lot for your answers.

marked as duplicate by Ulrich Schwarz, HalosGhost, Rui F Ribeiro, GAD3R, Wildcard Dec 2 '16 at 21:44

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


Because LDAP authentication and key-pair authentication are two separate authentication regimes, neither of which cares what the other has to say. SSH will keep trying to use any available means to authenticate until it finds one that works. This can be mitigated through proper configuration (read up on pam, for example).

Not the answer you're looking for? Browse other questions tagged or ask your own question.