On Thu, Apr 20, 2006 at 09:01:52AM -0400, Gabriel O'Brien wrote:
> My goal is to have SSH allow authorized_keys and OPIE authentication but
> deny all other forms of authentication. Obviously I want authentication
> to be denied if the user has neither configured as well.
>
> # auth
> auth required pam_nologin.so no_warn
> auth sufficient pam_opie.so no_warn
> no_fake_prompts
> auth requisite pam_opieaccess.so no_warn allow_local
I'm looking at the last line there and the pam_opieaccess manpage:
---
The pam_opieaccess module is used in conjunction with the pam_opie(8) PAM
module to ascertain that authentication can proceed by other means (such
as the pam_unix(8) module) even if OPIE authentication failed.
---
It looks like that pam_opieaccess.so line might be allowing logins to
continue.
My thought would be that you should try this:
|# auth
|auth required pam_nologin.so no_warn
|auth sufficient pam_opie.so no_warn no_fake_prompts
|auth required pam_ssh.so try_first_pass
|auth required pam_deny.so no_warn
--
Ian Tegebo
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
