similar to: [Bug 1904] sshd refuses certificate-based authentication if password has expired

https://bugzilla.mindrot.org/show_bug.cgi?id=1904 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |WORKSFORME --- Comment #4 from Damien Miller <djm at

https://bugzilla.mindrot.org/show_bug.cgi?id=1904 Tomas Mraz <t8m at centrum.cz> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |t8m at centrum.cz --- Comment #7 from Tomas Mraz <t8m at centrum.cz> --- Actually pam_unix from Linux-PAM 1.3.0

https://bugzilla.mindrot.org/show_bug.cgi?id=1904 Summary: sshd refuses certificate-based authentication if password has expired Product: Portable OpenSSH Version: 4.3p2 Platform: All OS/Version: All Status: NEW Severity: normal Priority: P2 Component: sshd AssignedTo:

https://bugzilla.mindrot.org/show_bug.cgi?id=1904 mathew <meta at pobox.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|WORKSFORME |--- --- Comment #5 from mathew <meta at pobox.com> --- %

https://bugzilla.mindrot.org/show_bug.cgi?id=1904 mathew <meta at pobox.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |RESOLVED Resolution|--- |FIXED --- Comment #8 from mathew <meta at pobox.com> ---

The reason I ask about the patches is because I think the problem you're seeing might actually be a bug in pam_unix.so.1 - it's something to try at least. We don't use password aging and we don't use the "passwd" command to change passwords, so we haven't run into this at our site even though we probably don't have pam_unix.so patched up. Also, the passwd

https://bugzilla.mindrot.org/show_bug.cgi?id=1773 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |FIXED Status|REOPENED |RESOLVED --- Comment #10 from Damien Miller <djm at

The auth-pam.c of sshd server contains a small flaw that allows empty password logins even if "PermitEmptyPasswords" option in the sshd config file is set to "no". The scenario is as follows: Using ssh the user tries to logon to the machine using an account that has empty password. If the user presses enter on the password prompt (NULL password) access is

https://bugzilla.mindrot.org/show_bug.cgi?id=3749 Bug ID: 3749 Summary: RELEASE_KEY.asc at https://www.openssh.com/portable.html is expired Product: Portable OpenSSH Version: 9.9p1 Hardware: Other OS: All Status: NEW Severity: enhancement Priority: P5 Component:

Hi Darren/Damien, Sorry for responding so late. Still hope we can get this sorted out. Yes I am indeed using PAM for ssh authentication and disabling priv seperation is a no-go for us since it opens up a security loophole. From what I can see in ptree and auth logs, when the child passwd process returns with SIGCHLD, the parent sshd process terminates. Sshd logs are as follows as requested at

Damien Miller wrote: > On Thu, 2 Feb 2017, Adam Eijdenberg wrote: > >> On Thu, Feb 2, 2017 at 10:42 AM Damien Miller <djm at mindrot.org> wrote: >>> On Thu, 2 Feb 2017, Adam Eijdenberg wrote: >>>> I guess a case could be made for ssh-add to always set a timeout when >>>> adding a certificate with an expiry time, but I think for now I'm

https://bugzilla.mindrot.org/show_bug.cgi?id=1908 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED Resolution|--- |FIXED --- Comment #8 from Damien Miller <djm at

https://bugzilla.mindrot.org/show_bug.cgi?id=1908 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |CLOSED --- Comment #9 from Damien Miller <djm at mindrot.org> --- Close all resolved bugs after 7.3p1 release

http://bugzilla.mindrot.org/show_bug.cgi?id=562 Summary: sshd and password has expired (password aged) Product: Portable OpenSSH Version: 3.6.1p1 Platform: ix86 OS/Version: Linux Status: NEW Severity: normal Priority: P2 Component: sshd AssignedTo: openssh-unix-dev at mindrot.org

https://bugzilla.mindrot.org/show_bug.cgi?id=1773 Damien Miller <djm at mindrot.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #2713|0 |1 is obsolete| | --- Comment #7 from Damien Miller <djm at mindrot.org> ---

Hello, I found this Morning a Message in my Logs, that is new for me and I never seen this before? Is this a Error in the Certificate System?? The certificate for www.example.at has expired Datum: 08.07.17 06:31 Von: root <gjn+www at example.at> An: gjn+www at example.at ################# SSL Certificate Warning ################ Certificate for hostname 'www.example.at', in

On Thu, Feb 2, 2017 at 10:42 AM Damien Miller <djm at mindrot.org> wrote: > On Thu, 2 Feb 2017, Adam Eijdenberg wrote: > > I guess a case could be made for ssh-add to always set a timeout when > > adding a certificate with an expiry time, but I think for now I'm > > happy enough to do that on our end. > > That sounds like a fine idea. Damien, to clarify did

Yes. Sorry about this.Sent from my Samsung Galaxy smartphone. -------- Original message --------From: Masaki Nemoto <itml at ma3ki.net> Date: 11/11/2018 10:00 (GMT+02:00) To: dovecot at dovecot.org Subject: The SSL certificate of repo.dovecot.org has expired. HiThe SSL certificate of https://repo.dovecot.org has expired.Do you have plans to update it? -------------- next part

Hi List Just had one of my servers fail serving web pages and apache produced a log file of nearly 1,000,000 lines and 130Mb in about 18 hours with the following: "SSL Library Error: -8181 Certificate has expired Unable to verify certificate 'Server-Cert'. Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the problem can be resolved."

Just FYI I guess, you could also run your own CA and sign stuff yourself. After all, your RPMs are also self-signed ;-)