SSH then disconnects.Īll of this is SSH's doing, and I don't see any SSH options to configure this behavior.

Next, SSH remembers that PAM told it the password had expired, prints a warning message, and asks PAM to have the user change the password.

It then sets up the SSH login session and runs the PAM session stage. It doesn't need PAM for this, so it doesn't run the auth stage.

SSH performs key-based authentication.

The account stage notices that the password has expired, and lets SSH know.

SSH runs the PAM account stage, which verifies that the account exists and is valid.

The order of operations that causes the expired password prompt is as follows: UPDATE#3: SERVER:/etc/pam.d # cat common-account UPDATE#2: The solution can't be: set the users password to never expire UPDATE#1: The solution can't be: 'UsePAM no' SERVER:~ # cat /etc/pam.d/sshd The question: How can we set the PAM or sshd config to allow users to log in if they have a valid SSH key and they're password expired? - Without popping up 'change your password'. The problem: If the password expires for a user that uses pubkey login, then the user will be prompted to change password. The users logs in via SSH and pubkey (mixed, some user uses password, some use ssh key)

User account has expired