Disable pam_nologin for SSH connections
ClosedPublic
Actions

Authored by dereckson on Apr 28 2017, 09:42.

Tags

None

Referenced Files

	F19495805: D975.id2508.diff
	Sun, Dec 28, 17:43

	Unknown Object (File)
	Fri, Dec 26, 14:27

	Unknown Object (File)
	Fri, Dec 26, 14:13

	Unknown Object (File)
	Thu, Dec 25, 06:34

	Unknown Object (File)
	Wed, Dec 24, 06:58

	Unknown Object (File)
	Tue, Dec 23, 18:02

	Unknown Object (File)
	Mon, Dec 22, 13:13

	Unknown Object (File)
	Mon, Dec 22, 04:51

View All Files

Subscribers

None

Details

Reviewers

Sandlayth

Maniphest Tasks

T1194: Disable pam_nologin on Eglide

Commits

rOPS7277030d10a6: Disable pam_nologin for SSH connections

Summary

systemd likes to touch /run/nologin to prevent SSH connections
while not fully initialized, a behavior frowned upon as there
isn't any warranty the file will be removed on system failure.

Furthermore, restrict non root login isn't a solution on servers
where root access isn't possible through SSH.

Fixes T1194.

Test Plan

Running the state on Eglide, output was well the expected diff:

-account    required     pam_nologin.so                                                                                        
+#account    required     pam_nologin.so