Disable pam_nologin for SSH connections
ClosedPublic
Actions

Authored by dereckson on Apr 28 2017, 09:42.

Tags

None

Referenced Files

	F25122574: D975.id2508.diff
	Tue, Mar 31, 09:13

	Unknown Object (File)
	Mon, Mar 30, 10:15

	Unknown Object (File)
	Sun, Mar 29, 09:49

	Unknown Object (File)
	Wed, Mar 25, 20:29

	Unknown Object (File)
	Wed, Mar 25, 16:49

	Unknown Object (File)
	Fri, Mar 20, 13:40

	Unknown Object (File)
	Tue, Mar 17, 23:31

	Unknown Object (File)
	Tue, Mar 17, 16:18

View All Files

Subscribers

None

Details

Reviewers

Sandlayth

Maniphest Tasks

T1194: Disable pam_nologin on Eglide

Commits

rOPS7277030d10a6: Disable pam_nologin for SSH connections

Summary

systemd likes to touch /run/nologin to prevent SSH connections
while not fully initialized, a behavior frowned upon as there
isn't any warranty the file will be removed on system failure.

Furthermore, restrict non root login isn't a solution on servers
where root access isn't possible through SSH.

Fixes T1194.

Test Plan

Running the state on Eglide, output was well the expected diff:

-account    required     pam_nologin.so                                                                                        
+#account    required     pam_nologin.so