On Thu, Apr 20, 2006 at 09:01:52AM -0400, Gabriel O'Brien wrote:
> My goal is to have SSH allow authorized_keys and OPIE authentication but 
> deny all other forms of authentication.  Obviously I want authentication 
> to be denied if the user has neither configured as well.
> # auth
> auth            required        pam_nologin.so          no_warn
> auth            sufficient      pam_opie.so             no_warn 
> no_fake_prompts
> auth            requisite       pam_opieaccess.so       no_warn allow_local
I'm looking at the last line there and the pam_opieaccess manpage:

     The pam_opieaccess module is used in conjunction with the pam_opie(8) PAM
     module to ascertain that authentication can proceed by other means (such
     as the pam_unix(8) module) even if OPIE authentication failed.

It looks like that pam_opieaccess.so line might be allowing logins to

My thought would be that you should try this:
|# auth
|auth  required        pam_nologin.so          no_warn
|auth  sufficient      pam_opie.so             no_warn no_fake_prompts
|auth  required        pam_ssh.so              try_first_pass
|auth  required        pam_deny.so             no_warn

Ian Tegebo
freebsd-questions@freebsd.org mailing list
To unsubscribe, send any mail to "[EMAIL PROTECTED]"

Reply via email to