openssh unix dev - Aug 2003 - SSH-2.0-OpenSSH_3.6.1p2 - Bug #442

"DiNisco, Jeff" wrote:
> I read in the change log that you fixed a bug that denies access to
> accounts with locked passwords.  My environment is dependent on public
> key authentication.  The account used does not have a person associated
> with it but rather a service.  I want to keep the password locked.  Is
> there a way to turn this fix off?
What platform are we talking about?

Depending on that you can set the password entry to something that doesn't
mean "locked" to your system (on Solaris, for example, the system
accounts
use "NP" or "*NP*" to denote "no password
authentication").  This will
still allow the public-key authentication  but not passwords.

I tried to cover this in the man page changes.

Apart from that you could undo the patch.

(cc'ed the list, others might have similar issues).

-- 
Darren Tucker (dtucker at zip.com.au)
GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4  37C9 C982 80C7 8FF4 FA69
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

On Wed, 27 Aug 2003, Darren Tucker wrote:
> What platform are we talking about?
>
> Depending on that you can set the password entry to something that
doesn't
> mean "locked" to your system (on Solaris, for example, the system
accounts
> use "NP" or "*NP*" to denote "no password
authentication").  This will
> still allow the public-key authentication  but not passwords.
NP yes.

If you see *NP* it means that the NIS+ passwd.org_dir table permissions or
the ACIs on the LDAP object were to restrictive for you to read the entry.
Or that nscd choose to block it (NIS+ only).

Or it means that someone manually put *NP* into the field will not
understanding what it is really used for ;-)

-- 
Darren J Moffat