How to avoid password expiration for ssh?

[Kirill Cherkashin]

Hi,

I'm using ssh with private/public exchange in automated script for transferring oracle archive logs between two machines. Unfortunately, our security guy urges us to turn password expiration on.
I always reckoned that using key pair exchange is smart way to avoid constant password change and it's especially useful for service accounts. However, I found this message in ssh log:

Disconnecting: Password change required but no TTY available


so, is it possible somehow to avoid password expiration for ssh?

[Steven E. Protter]

In SAM on the target server

Users

modify

Disable password aging.

Of course this will require you to manually change it without remeinders to maintain security.

SEP

[Kirill Cherkashin]

Steven,


1) password expiration should be turn on for this account.
i.e. password expiration should works in standart way for telnet and ftp but ssh and sftp could avoid it.
2) i don't want to make any regular manual password changes at all.

[Vijaya Kumar_3]

No, there is no seperate password expiration available for SSH/SCP.

So there is no other go you can handle this, but you always have an option to change using SAM of modprpw command with your unix administrator.

Thanks
Vijay

[RAC_1]

I think you cant do that, ssh is checking account details, and when it sees it is expired, it gives messages and exits.

[Jun Wang_2]

I have exactly the same question.

[Jane Bell]

I have exactly the opposite problem - accounts that are expired and/or disabled but SSH ignores the status and allows the user to login! Obviously I am concerned that disabled accounts can still login!! We also have AIX servers and they work as you describe (ie they check the password status). As yet Ive not worked out why the aix servers work in the opposite way around to the hp servers - if I do then I will probably have solved your question!

Our hp servers do check the password status if password ( rather than passphrase/key ) authentication is performed.

Running openssh3.8p1 ( built locally )

[Steven E. Protter]

The only way to disable for ssh is to disable for the user. This is a very bad idea and will make you fail a security audit if you have such things done.

SEP

[Jane Bell]

Yep, thats the way it should be - but no one seems to have told our servers - much to my annoyance!

The debugging continues.....

[Sridhar Bhaskarla]

Hi Jane,

I fear you might have compiled your openssh without PAM support (means without --with-pam option).

3.8p1 is superceded by 3.8.1p1 now. I suggest you recompile the new version with PAM support and it should obey your password rules.

-Sri