11

/etc/ssh/sshd_config by default has the following line

UsePAM yes

I read through available documentation and came to the conclusion that PAM is not used if I only use public-key login. What possible negative consequences could there be if I disable PAM? e.g.

UsePAM no
1

1 Answer 1

14

PAM does not just do authentication, but authorisation and session services. You probably want to keep it on as it adds quite a bit of flexibility.

PAM will be called for a successful pubkey authentication, because session and account services are still checked.

PAM can do things SSH cannot. This list is not exhaustive:

  • Deny a user access if SELinux is not in enforcing mode (if thats your thing).
  • Set resource limits like max processes and max logins allowed.
  • Flexibly deny a user based off of their user and remote source IP (possible in SSH too, but is pretty terse in PAM)
  • Setup a series of environment variables you may want to pass.
  • Create a home directory for a user if it did not exist.
  • Deny users based off of the time/date of their access attempt.
  • Deny inactive users.
  • Deny users using an invalid shell.
  • Setup key logging facilities of input.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.