\u4eca\u5929\u542c\u670b\u53cb\u8bf4\u4e86\u4e00\u4e2a\u9700\u6c42\uff0c\u5927\u610f\u662f\u5728\u4f7f\u7528sftp\u4f20\u6587\u4ef6\uff0c\u5f88\u591a\u4e2a\u8d26\u6237\u540c\u65f6\u4f7f\u7528\uff0c\u56e0\u4e3a\u5b89\u5168\u9700\u6c42\u5bc6\u7801\u5fc5\u987b90\u5929\u66f4\u6362\uff0c\u539f\u672c\u662f\u7528\u79d8\u94a5\u767b\u5f55\u53ef\u4ee5\u7ed5\u8fc7\u66f4\u6362\u5bc6\u7801\u7684\u8981\u6c42\uff0c\u4f46\u662f\u5ba2\u6237\u5374\u8981\u6c42\u53ea\u80fd\u4f7f\u7528\u5bc6\u7801\u767b\u5f55\uff0c\u8fd9\u6837\u5982\u679c90\u5929\u66f4\u6362\u5c31\u5c5e\u5b9e\u8ba9\u4eba\u5934\u75bc\uff0c\u6240\u4ee5\u5c31\u60f3\u540c\u65f6\u63d0\u4f9b\u5bc6\u7801\u548c\u79d8\u94a5\uff0c\u5982\u679c\u5bc6\u780190\u5929\u8fc7\u671f\uff0c\u8ba9\u5ba2\u6237\u901a\u8fc7\u79d8\u94a5\u767b\u5f55\u81ea\u5df1\u4fee\u6539\u5bc6\u7801\uff0c\u8fd9\u6837\u53ef\u4ee5\u8282\u7701\u4eba\u529b\u3002\u4f46\u662f\u5728\u4f7f\u7528\u7684\u65f6\u5019\u5374\u53d1\u73b0\u5bc6\u7801\u4e00\u65e6\u8fc7\u671f\uff0c\u79d8\u94a5\u4e00\u6837\u4f1a\u63d0\u793a\u4fee\u6539\u5bc6\u7801\u3002\u540e\u6765\u7ecf\u8fc7\u67e5\u8d44\u6599\u53d1\u73b0pam\u5728\u53d1\u73b0\u5bc6\u7801\u8fc7\u671f\u4e4b\u540e\u4e0d\u7ba1\u662f\u5bc6\u7801\u767b\u5f55\u8fd8\u662f\u79d8\u94a5\u767b\u5f55\u90fd\u4f1a\u7ed9sshd\u53d1\u9001\u4e00\u4e2a\u5bc6\u7801\u8fc7\u671f\u7684\u8b66\u544a\uff0c\u800c\u5f53sshd\u6536\u5230\u8fd9\u4e2a\u8fc7\u671f\u7684\u6d88\u606f\u540e\u5c31\u4f1a\u4e2d\u65ad\u767b\u5f55\uff0c\u5bfc\u81f4\u79d8\u94a5\u4e5f\u65e0\u6cd5\u767b\u9646\u3002<\/p>\n\n\n\n
The order of operations that causes the expired password prompt is as follows:<\/p>\n\n\n\n
account<\/code> stage, which verifies that the account exists and is valid. The account<\/code> stage notices that the password has expired, and lets SSH know.<\/li>- SSH performs key-based authentication. It doesn’t need PAM for this, so it doesn’t run the
auth<\/code> stage. It then sets up the SSH login session and runs the PAM session<\/code> stage.<\/li>- Next, SSH remembers that PAM told it the password had expired, prints a warning message, and asks PAM to have the user change the password. SSH then disconnects.<\/li><\/ul>\n\n\n\n
All of this is SSH’s doing, and I don’t see any SSH options to configure this behavior. So unless you want to build a custom version of SSH and\/or PAM, the only option I see is to prevent PAM from reporting the expired password to SSH. If you do this, it will disable expired password checks over SSH entirely<\/strong>, even if the user is logging in over SSH with a password. Other (non-SSH) methods of login will still check password expiration.<\/p>\n\n\n\nYour current pam.d\/sshd<\/code> file has a account include common-account<\/code> entry. I presume there’s a common-account<\/code> file which contains a reference to pam_unix.so<\/code>. This is the line that checks for an expired password.<\/p>\n\n\n\nYou probably don’t want to touch the common-account<\/code> file itself, since it’s used for other login methods. Instead, you want to remove the include<\/code> from your pam.d\/sshd<\/code> file. If there are other functions in common-account<\/code> besides pam_unix.so<\/code>, you probably want to put them directly into pam.d\/sshd<\/code>.<\/p>\n\n\n\nFinally, remember that this is a modification to the security of your system and you shouldn’t just blindly trust me to give you good advice. Read up on how PAM works if you’re unfamiliar with it. Some starting places might be man 7 PAM<\/code>, man 5 pam.conf<\/code>, and man 8 pam_unix<\/code>.<\/p>\n\n\n\nAn option was added to pam_unix.so (around Feb-2016) called no_pass_expiry (source code change here<\/a> or man page here<\/a>). Basically it tells pam_unix to ignore an expired password if something other than pam_unix was used for auth, e.g. if sshd performed the auth.<\/p>\n\n\n\nAs a result, if you have a version of pam_unix.so that contains that option, you should be able to configure PAM to:<\/p>\n\n\n\n
- Still warn but don’t require a change to an expired password if an SSH key was used to authenticate via ssh<\/li>
- Require a password change of an expired password if a login\/password via pam_unix.so was used to authenticate via ssh<\/li>
- Not impact any other auth sequence (e.g. via the login service).<\/li><\/ol>\n\n\n\n
For example, I configured a RHEL 7 server to do the above by simply updating \/etc\/pam.d\/sshd and adding pam_unix.so no_pass_expiry to both the account and password types, e.g.<\/p>\n\n\n\n
\u4e09\u3001\u89e3\u51b3\u529e\u6cd5<\/h2>\n\n\n\naccount required pam_nologin.so\naccount sufficient pam_unix.so no_pass_expiry\naccount include password-auth\npassword sufficient pam_unix.so no_pass_expiry\npassword include password-auth<\/pre>\n\n\n\n\u56db\u3001\u5f00\u901asftp\u529f\u80fd\uff0c\u4f46\u7981\u7528ssh\u767b\u5f55\u7684\u65b9\u6cd5<\/strong><\/h2>\n\n\n\n#\u4fee\u6539\/etc\/passwd\u4e2d\u5bf9\u5e94\u7684shell\u4e3a\uff1a\nowen:x:500:500::\/home\/owen:\/usr\/libexec\/openssh\/sftp-server<\/pre>\n\n\n\n<\/p>\n","protected":false},"excerpt":{"rendered":"
\u4e00\u3001\u9700\u6c42 \u4eca\u5929\u542c\u670b\u53cb\u8bf4\u4e86\u4e00\u4e2a\u9700\u6c42\uff0c\u5927\u610f\u662f\u5728\u4f7f\u7528sftp\u4f20\u6587\u4ef6\uff0c\u5f88\u591a\u4e2a\u8d26\u6237\u540c\u65f6\u4f7f\u7528 … \u7ee7\u7eed\u9605\u8bfb