Why are PasswordAuthentication and UsePAM mutually exclusive?

From: Jim Faulkner (jfaulkne_at_ccs.neu.edu)
Date: 07/21/04

  • Next message: Neil W Rickert: "Re: Openssh breaks xauth" 
    Date: Wed, 21 Jul 2004 16:08:17 -0400

    I have a fairly complicated authentication setup on a Suse 9.1 machine,
    which runs OpenSSH 3.8p1. I allow local users to login, I allow LDAP
    users to login with kerberos passwords, and I also allow LDAP users to
    log in with LDAP passwords.

    This setup required me to modify many of the files under /etc/pam.d, so
    that both LDAP and kerberos passwords are sufficient for login.

    My sshd_config contains these lines:
    PasswordAuthentication no
    UsePAM yes

    With this configuration, most newer SSH clients can connect. However,
    some older clients can't connect, and even some newer clients require
    changing an unintuitive setting in order to connect. For example, newer
    ssh.com clients require you to specify 'keyboard-interactive
    authentication' instead of 'password authentication', which is very
    unintuitive for the user. Older ssh.com clients do not include the
    keyboard-interactive option at all.

    If I enable PasswordAuthentication and/or disable UsePAM, no one can
    connect using a password, but I do not get any pam error messages in my
    log file. Apparently PasswordAuthentication completely ignores
    both kerberos and ldap.

    So I guess I have a couple questions:

    1) What is sshd trying to authenticate against when PasswordAuthentication
    is enabled? I'm not getting any pam_ldap or pam_krb5 errors in my log
    file when that option is enabled, so sshd seems to be completely ignoring
    my authentication setup.

    2) Why are PasswordAuthentication and UsePAM mutually exclusive? eg. Why
    can't I type in a password when PasswordAuthentication is enabled and have
    sshd pass on the password to PAM?

    I'd really like to have the maximum compatibility with various ssh
    clients, but it doesn't seem like its going to happen unless I can get
    PasswordAuthentication and PAM talking to each other.

    thanks for any help,
    Jim Faulkner

  • Next message: Neil W Rickert: "Re: Openssh breaks xauth"

    Relevant Pages

    • Re: LDAP authentication security ?
      ... Using an internally rooted CA can be less expensive, but it is less easy to get all of the clients to trust your certs issued by this CA, especially in an environment that includes non-Windows machines that can't take advantage of auto enrollment or GPO for distributing trusted roots. ... Co-author of "The .NET Developer's Guide to Directory Services Programming" ... If the application supports SASL bind with either GSS-SPNEGO or DIGEST authentication, then you can use that directly with AD without needing to secure the channel as those authentication mechanisms are already secure without channel encryption. ... Simple bind is the authentication mechanism in the LDAP V3 spec and is supported by all LDAP directories. ...
      (microsoft.public.windows.server.security)
    • Re: pam_ldap and password management and rsh/ssh without password
      ... > authentication that doesn't require a password will fail. ... > that accounts may be expired (via ldap). ... pam_ldap has to actually be able to bind to the ldap server as the user ... disadvantage to this is that then the clients are managing the password ...
      (comp.unix.solaris)
    • Re: LDAP Authentification between Debian and Active Directory
      ... > that don't need LDAP authentification, but the most of our clients still ... It is only as secure as the kerberos servers are. ... For kerberos authentication (and LDAP authentication only ... UNIX clients. ...
      (Debian-User)
    • Re: sshd known_hosts query
      ... >> I'd say turn PasswordAuthentication off, ... Sometimes you can't set keys - I certainly ... > authentication PLUS passwords works fine. ... sshed to `postgres' on one of my machines... ...
      (uk.comp.os.linux)
    • Re: security question
      ... > logins on the local subnet with password authentication while at the same ... > time restricting external logins to public-key authentication on a single ... I did not see a way to allow one sshd session to have 2 separted ... & "PasswordAuthentication yes". ...
      (SSH)