[SSSD-users] Re: sshkey use allows expired account user to access system
On 6/2/22 13:36, Jim Kinney wrote:
It seems if valid ssh keys exist, the expired account status
doesn't
block login with ssh keys.
I believe that's because *users* don't expire. *Passwords* do. If you
aren't authenticating with passwords, then password expiration doesn't
affect the account.
This is one of the reasons that users should consider using Kerberos, or
SSH certificate systems, rather than SSH keys.
https://smallstep.com/blog/use-ssh-certificates/