Re: sshd permits logon using disabled user?
- Date: Thu, 24 Jan 2019 17:16:37 +0100
- From: Stefan Baur <X2Go-ML-1@xxxxxxxxxxxx>
- Subject: Re: sshd permits logon using disabled user?
Am 24.01.19 um 16:59 schrieb Corinna Vinschen: > I think refusing an account manually and deliberately disabled by an > admin makes lots of sense. > > I'm not so sure about locked out accounts. THis might need some > discussion. It's been a while since I did Windows administration, so I can't really make a recommendation here ... BUT: If an admin can lock out an account (separately from disabling it entirely), say, by setting an initial password, checking the "user must change password on first login", and also checking "user is not allowed to change password" simultaneously (if that's possible), or, say, by just setting a random password without telling it to anyone ever, followed by firing so many login attempts at the account that it gets locked out, then telling them apart and treating locked out accounts differently would make sense, IMO. Kind Regards, Stefan Baur -- BAUR-ITCS UG (haftungsbeschränkt) Geschäftsführer: Stefan Baur Eichenäckerweg 10, 89081 Ulm | Registergericht Ulm, HRB 724364 Fon/Fax 0731 40 34 66-36/-35 | USt-IdNr.: DE268653243
Description: OpenPGP digital signature