[Bug 2162945] Re: [UBUNTU 22.04] Non-root users are prompted to reset their password after PASS_MAX_DAYS expiry, despite having Public Key Authentication enabled.

Hello Dineshkanna, yes, this is the behavior on Ubuntu (and on many other Linux distributions): an expired password will block or interrupt an SSH session even if the user successfully authenticates using an SSH Public Key. Thi sis because PAM is used to handle system security and it's done in two phases, when logging in via ssh: - auth phase: sshd validates the cryptographic public key; this succeeds without checking your password - account phase: sshd hands the session over to PAM to verify account health via /etc/pam.d/sshd The PAM module pam_unix.so checks the user's password aging attributes in /etc/shadow (governed by PASS_MAX_DAYS). If the password is older than allowed, PAM returns an account expired error. OpenSSH then forces a password change or rejects the connection. There are two solutions: 1) <recommended> If specific non-root users or functional user accounts rely strictly on SSH keys, disable their password aging entirely and disable expiration for that specific user: sudo chage -M -1 <username> (verify: sudo chage -l <username> ) 2) Or configure PAM to bypass expiration for ssh generally (system-wide). It can be done by opening /etc/pam.d/sshd and commenting out line: # @include common-account and by explicitly adding the pam_unix.so module with the no_pass_expiry flag below it: account requisite pam_unix.so no_pass_expiry ** Package changed: linux (Ubuntu) => openssh (Ubuntu) ** Changed in: openssh (Ubuntu) Importance: Undecided => Medium ** Changed in: openssh (Ubuntu) Status: New => Opinion ** Also affects: ubuntu-z-systems Importance: Undecided Status: New ** Changed in: ubuntu-z-systems Status: New => Opinion ** Changed in: ubuntu-z-systems Importance: Undecided => Medium ** Changed in: ubuntu-z-systems Assignee: (unassigned) => Skipper Bug Screeners (skipper-screen-team) -- You received this bug notification because you are subscribed to linux in Ubuntu. Matching subscriptions: Bgg, Bmail, Nb https://bugs.launchpad.net/bugs/2162945 Title: [UBUNTU 22.04] Non-root users are prompted to reset their password after PASS_MAX_DAYS expiry, despite having Public Key Authentication enabled. Status in Ubuntu on IBM z Systems: Opinion Status in openssh package in Ubuntu: Opinion Bug description: ---Problem Description--- Even when Public Key Authentication is configured and functioning correctly, non-root users are being forced to reset their passwords once the maximum password age (PASS_MAX_DAYS) is exceeded. This behavior contradicts the expected functionality, where password expiry should not impact users relying solely on key-based authentication. ---Steps to Reproduce--- 1. Create a Ubuntu 22.04 s390x zvsi. 2. Create a non root user. 3. Add the public key to the user home directory. 4. After the specified PASS_MAX_DAYS in /etc/login.defs try to login as the user. 5. The user is promted to enter the current password the reset the password. ---Note--- We are changing the PASS_MAX_DAYS to 90 days in the image for the best practices. We are enabling the PubkeyAuthentication We are disabling the PasswordAuthentication Contact Information = Dineshkanna / dineshkanna.m@ibm.com To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-z-systems/+bug/2162945/+subscriptions