ReadMeFeed / Community knowledge
Real questions. Useful conversations. Find the people who know your stack.
Linux systems utilize the pam_unix and pam_expire modules to enforce password aging policies based on the /etc/shadow file. While these modules consistently force a password change during local TTY logins, the behavior varies when credentials expire for users connecting via non-interactive SSH sessions (e.g., SFTP or automated SCP transfers). The goal is to
Authentication failure after password expiry When a user's password has expired, PAM's pam_unix module returns the "Authentication token expired" error. The LightDM greeter receives this response but displays only a generic "Authentication failure" message, offering no in-gui way to reset the password and forcing the user to switch to a TTY. At the same time
Goal In a zsh script that authenticates users via the zsh/pam module, the script must detect when the user’s password has expired and prompt for a new one, all while keeping the least-privilege model intact. Constraints & Uncertainty The module exposes the return code PAM_NEW_AUTHTOK_REQD but does not provide a built‑in UI for the password‑change convers
Password expiry versus account expiry during key-based SSH sessions On openSUSE Leap 15.x, the shadow suite stores password aging in /etc/shadow , managed through chage or YaST. Two mechanisms are easy to conflate: password expiry past the maximum age, which normally forces an immediate change at the next login via PAM, and a hard account expiry date, which
Goal: allow a standard local user with an expired /etc/shadow password to authenticate with sudo while keeping that user out of the sudo group and blocking graphical login until the password is reset. Uncertainty: Linux Mint authenticates sudo through PAM, and pam_unix can return PAM_NEW_AUTHTOK_REQD when the password age exceeds the limit in /etc/login.defs
Credential Lifecycle Management Debian systems utilize /etc/login.defs to define system-wide defaults for PASS_MAX_DAYS and PASS_WARN_AGE , which govern the lifecycle of user credentials. These settings are intended to enforce periodic password rotation to maintain security standards. PAM Integration Constraints The Pluggable Authentication Modules (PAM) fra
Arch Linux delegates local authentication to PAM, where pam_unix reads /etc/shadow . Two shadow fields matter here: password expiry, configured with chage -M , which forces a change at next authentication, and account expiration, set with chage -E , which denies access after the given date. OpenSSH can run with UsePAM yes , yet public-key authentication does
Authentication Behavior with Expired LDAP Passwords RHEL 9's default authentication stack uses SSSD as the primary backend for LDAP/AD integration, with pam_sss.so delegating authentication to SSSD. The pam_unix.so module handles local password expiration checks, but when LDAP passwords expire, the system's behavior depends on SSSD's cache configuration. The
Least Privilege Authentication The goal is to confirm the precise failure mode when a standard, non-root Linux Mint user attempts authentication with credentials flagged as expired by the system. Constraints and Uncertainty The exact behavior is dependent on the underlying PAM configuration, not a default Mint feature alone. Does the authentication process r
ssh
linuxmint
zsh
opensuse
debian
archlinux
redhat