diff options
author | Darren Tucker <dtucker@zip.com.au> | 2006-02-23 21:35:30 +1100 |
---|---|---|
committer | Darren Tucker <dtucker@zip.com.au> | 2006-02-23 21:35:30 +1100 |
commit | a4904f7bf19fb091b9fcf8059dedd5c5198fc039 (patch) | |
tree | 384681017d1879a14619dabf375b265bf6084f7c | |
parent | 94413cf32ba932537ef215b07eb1833e297fcae5 (diff) |
- (dtucker) [sshd_config sshd_config.5] Update UsePAM to reflect current
reality. Pointed out by tryponraj at gmail.com.
-rw-r--r-- | ChangeLog | 6 | ||||
-rw-r--r-- | sshd_config | 13 | ||||
-rw-r--r-- | sshd_config.5 | 5 |
3 files changed, 16 insertions, 8 deletions
@@ -1,3 +1,7 @@ +2006023 + - (dtucker) [sshd_config sshd_config.5] Update UsePAM to reflect current + reality. Pointed out by tryponraj at gmail.com. + 2006022 - (dtucker) [openbsd-compat/openssl-compat.{c,h}] Minor tidy up: only compile in compat code if required. @@ -3877,4 +3881,4 @@ - (djm) Trim deprecated options from INSTALL. Mention UsePAM - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu -$Id: ChangeLog,v 1.4133 2006/02/22 11:24:47 dtucker Exp $ +$Id: ChangeLog,v 1.4134 2006/02/23 10:35:30 dtucker Exp $ diff --git a/sshd_config b/sshd_config index 4957dd1a..57f9a17b 100644 --- a/sshd_config +++ b/sshd_config @@ -71,12 +71,13 @@ # Set this to 'yes' to enable PAM authentication, account processing, # and session processing. If this is enabled, PAM authentication will -# be allowed through the ChallengeResponseAuthentication mechanism. -# Depending on your PAM configuration, this may bypass the setting of -# PasswordAuthentication, PermitEmptyPasswords, and -# "PermitRootLogin without-password". If you just want the PAM account and -# session checks to run without PAM authentication, then enable this but set -# ChallengeResponseAuthentication=no +# be allowed through the ChallengeResponseAuthentication and +# PasswordAuthentication. Depending on your PAM configuration, +# PAM authentication via ChallengeResponseAuthentication may bypass +# the setting of "PermitRootLogin without-password". +# If you just want the PAM account and session checks to run without +# PAM authentication, then enable this but set PasswordAuthentication +# and ChallengeResponseAuthentication to 'no'. #UsePAM no #AllowTcpForwarding yes diff --git a/sshd_config.5 b/sshd_config.5 index 71a293ff..6e2de10d 100644 --- a/sshd_config.5 +++ b/sshd_config.5 @@ -677,7 +677,10 @@ If set to .Dq yes this will enable PAM authentication using .Cm ChallengeResponseAuthentication -and PAM account and session module processing for all authentication types. +and +.Cm PasswordAuthentication +in addition to PAM account and session module processing for all +authentication types. .Pp Because PAM challenge-response authentication usually serves an equivalent role to password authentication, you should disable either |