Arch Linux PAM Expiry Semantics and OpenSSH Public-Key Authentication: Which Account Checks Apply?
Arch Linux delegates local authentication to PAM, where pam_unix reads /etc/shadow . Two shadow fields matter here: password expiry, configured with chage -M , which forces a change at next authentication, and account expiration, set with chage -E , which denies access after the given date. OpenSSH can run with UsePAM yes , yet public-key authentication does