I'm testing out Ubuntu Landscape, but the only client I have available to me is only accessible via SSH. I've tried locking the user on it as described in the documentation, but when that's finished I can still SSH into the user just fine. I noticed the sudo command doesn't work on the "locked" user, however.

My questions are, what is the scope on the Landscape user lock, what does it look like when a locked user tries to log in, and is there a way to make it so that the lock targets SSH as well besides simply disabling SSH?

up vote 0 down vote accepted

There is actually nothing specific to landscape there.

In short, locked account are users for which the password entry starts with a "!", thus disabling password access (see man passwd on your system for more details). It generally doesn't look different from a failed password attempt.

ssh may still allow key based authentication for locked users depending on its configuration. UsePAM yes is known to have that effect, and is enabled by default on Ubuntu.

Here are a couple ways you can achieve user locking:

  • set UsePAM no in sshd_config
  • disable PubkeyAuthentication
  • not use locking mechanism but rather set expiration date on the user
  • set the shell of the user to /usr/sbin/nologin
  • there are probably other settings related to PAM you can use, but I'm not familiar enough with them

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.