SSH는 만료되면 새 비밀번호를 묻는 메시지를 표시하지 않습니다.

사용자의 기존 비밀번호가 만료되면 새 비밀번호를 묻는 메시지를 표시하도록 SSH를 설정하고 싶지만 현재 로그인할 수 없습니다. 인증 백엔드로 Kerberos를 사용하고 있습니다. 사용자의 비밀번호가 만료된 것을 확인할 수 있습니다.

kadmin:  getprinc demo
...
Password expiration date: Tue Oct 27 22:25:09 MDT 2020

콘솔, 로그인 프로세스 또는 kinit를 통해 로그인하려고 하면 새 비밀번호를 묻는 메시지가 나타납니다.

root@host2:~# login demo
Password: 
Password expired.  You must change it now.
Enter new password: 

root@host2:~# kinit -p demo
Password for [email protected]
Password expired.  You must change it now.
Enter new password: 

그러나 SSH를 통해 로그인하려고 하면 다음 오류가 발생합니다.

user1@host1:~$ ssh demo@host2
demo@host2's password: 
Permission denied, please try again.
demo@host2's password: 
Permission denied, please try again.
demo@host2's password: 
demo@host2: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).

auth.log비밀번호가 만료된 것으로 생각되는 파일을 볼 수 있습니다 .

Oct 28 17:41:09 blljmp02 sshd[10439]: debug3: receive packet: type 50 [preauth]
Oct 28 17:41:09 blljmp02 sshd[10439]: debug1: userauth-request for user demo service ssh-connection method password [preauth]
Oct 28 17:41:09 blljmp02 sshd[10439]: debug1: attempt 4 failures 3 [preauth]
Oct 28 17:41:09 blljmp02 sshd[10439]: debug2: input_userauth_request: try method password [preauth]
Oct 28 17:41:09 blljmp02 sshd[10439]: debug3: mm_auth_password entering [preauth]
Oct 28 17:41:09 blljmp02 sshd[10439]: debug3: mm_request_send entering: type 12 [preauth]
Oct 28 17:41:09 blljmp02 sshd[10439]: debug3: mm_auth_password: waiting for MONITOR_ANS_AUTHPASSWORD [preauth]
Oct 28 17:41:09 blljmp02 sshd[10439]: debug3: mm_request_receive_expect entering: type 13 [preauth]
Oct 28 17:41:09 blljmp02 sshd[10439]: debug3: mm_request_receive entering [preauth]
Oct 28 17:41:09 blljmp02 sshd[10439]: debug3: mm_request_receive entering
Oct 28 17:41:09 blljmp02 sshd[10439]: debug3: monitor_read: checking request 12
Oct 28 17:41:09 blljmp02 sshd[10439]: debug1: temporarily_use_uid: 199999/199999 (e=0/0)
Oct 28 17:41:09 blljmp02 sshd[10439]: debug1: restore_uid: 0/0
Oct 28 17:41:09 blljmp02 sshd[10439]: debug1: Kerberos password authentication failed: Password has expired
Oct 28 17:41:09 blljmp02 sshd[10439]: debug1: krb5_cleanup_proc called
Oct 28 17:41:09 blljmp02 sshd[10439]: debug3: mm_answer_authpassword: sending result 0
Oct 28 17:41:09 blljmp02 sshd[10439]: debug3: mm_request_send entering: type 13
Oct 28 17:41:09 blljmp02 sshd[10439]: Failed password for demo from 172.16.44.18 port 34012 ssh2

SSH에서 새 비밀번호를 묻는 메시지를 표시하려면 어떻게 해야 하나요?

우분투 18.04를 사용하고 있습니다. 다음은 내 PAM 구성입니다.

root@host2:~# cat /etc/pam.d/common-auth | egrep -v '(^#|^$)'
auth    [success=3 default=ignore]  pam_krb5.so minimum_uid=1000
auth    [success=2 default=ignore]  pam_unix.so nullok_secure try_first_pass
auth    [success=1 default=ignore]  pam_sss.so use_first_pass
auth    requisite           pam_deny.so
auth    required            pam_permit.so
auth    optional            pam_cap.so

root@host2:~# cat /etc/pam.d/common-account | egrep -v '(^#|^$)'
account [success=1 new_authtok_reqd=done default=ignore]    pam_unix.so 
account requisite           pam_deny.so
account required            pam_permit.so
account required            pam_krb5.so minimum_uid=1000
account sufficient          pam_localuser.so 
account [default=bad success=ok user_unknown=ignore]    pam_sss.so

root@host2:~# cat /etc/pam.d/common-password | egrep -v '(^#|^$)'
password    requisite           pam_pwquality.so retry=3
password    [success=3 default=ignore]  pam_krb5.so minimum_uid=1000 try_first_pass use_authtok
password    [success=2 default=ignore]  pam_unix.so obscure use_authtok try_first_pass sha512
password    sufficient          pam_sss.so use_authtok
password    requisite           pam_deny.so
password    required            pam_permit.so

root@host2:~# cat /etc/pam.d/common-session | egrep -v '(^#|^$)'
session [default=1]         pam_permit.so
session requisite           pam_deny.so
session required            pam_permit.so
session optional            pam_umask.so
session required        pam_mkhomedir.so umask=0022 skel=/etc/skel
session optional            pam_krb5.so minimum_uid=1000
session required    pam_unix.so 
session optional            pam_sss.so 
session optional    pam_systemd.so