Re: sshd permits logon using disabled user?

[Bill Stewart <bstewart at iname dot com>]

On Fri, Jan 25, 2019 at 3:36 AM Stefan Baur <X2Go-ML-1@baur-itcs.de> wrote:

> Not on Linux (and possibly other Unices).  There, it's perfectly valid
> to disable an account's password login (both locally and remote), but to
> at the same time allow ssh key file based logins for the same account.

But disabling _password login_ is an entirely separate issue from
disabling _the account itself_.

Before the fix, it was possible to log on to sshd using a disabled (or
locked) account.

There should be _no_ scenario where it is possible to log on using a
disabled/locked account.

(To state the obvious: That's the whole point of having
disabled/locked out flags - so the account cannot be used to log on.)

Regards,

Bill

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple