[Mageia-dev] SSH PAM configuration

Mon Aug 13 09:34:46 CEST 2012

Le 12/08/2012 21:57, David Walser a écrit :
+> Johnny A. Solbu wrote:
+>> On Sunday 12 August 2012 19:28, David Walser wrote:
+>>> Through the PAM configuration for SSH shipped with the openssh-server package, root login is broken.  Here's why.  /etc/pam.d/sshd has:
+>>> auth required pam_listfile.so item=user sense=deny file=/etc/ssh/denyusers
+>>>
+>>> The file /etc/ssh/denyusers has "root" in it by default.
+>>
+>> I read somewhere some time ago that PermitRootLogin in sshd_config is ignored if PAM is used.
+>> That may be the reason for this.
+>
+> Nope, I just tested it and that is not true.
+There is an explicit comment in the configuration file:
+# Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+
+My understanding is just than some specific PAM configuration would 
+eventually allow root user to authenticate through a password, instead 
+of a key.
+
+Regarding your original problem, feel free to commit the relevant 
+modifications.
+-- 
+BOFH excuse #405:
+
+Sysadmins unavailable because they are in a meeting talking about why 
+they are unavailable so much.
+