了解 sshd 配置中的 PasswordAuthentication

Question

我有一个仅支持密码身份验证的 OpenSSH 服务器：

[martin@ ~]$ ssh -v 10.10.1.183 -l root
OpenSSH_5.2p1 FreeBSD-20090522, OpenSSL 0.9.8k 25 Mar 2009
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: Connecting to 10.10.1.183 [10.10.1.183] port 22.
debug1: Connection established.
debug1: identity file /home/martin/.ssh/identity type 0
debug1: identity file /home/martin/.ssh/id_rsa type -1
debug1: identity file /home/martin/.ssh/id_dsa type 2
debug1: Remote protocol version 2.0, remote software version OpenSSH_6.7p1 Debian-5
debug1: match: OpenSSH_6.7p1 Debian-5 pat OpenSSH*
debug1: Enabling compatibility mode for protocol 2.0
debug1: Local version string SSH-2.0-OpenSSH_5.2p1 FreeBSD-20090522
debug1: SSH2_MSG_KEXINIT sent
debug1: SSH2_MSG_KEXINIT received
debug1: kex: server->client aes128-ctr hmac-sha1 none
debug1: kex: client->server aes128-ctr hmac-sha1 none
debug1: SSH2_MSG_KEX_DH_GEX_REQUEST(1024<2048<8192) sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_GROUP
debug1: SSH2_MSG_KEX_DH_GEX_INIT sent
debug1: expecting SSH2_MSG_KEX_DH_GEX_REPLY
debug1: Host '10.10.1.183' is known and matches the RSA host key.
debug1: Found key in /home/martin/.ssh/known_hosts:3
debug1: ssh_rsa_verify: signature correct
debug1: SSH2_MSG_NEWKEYS sent
debug1: expecting SSH2_MSG_NEWKEYS
debug1: SSH2_MSG_NEWKEYS received
debug1: SSH2_MSG_SERVICE_REQUEST sent
debug1: SSH2_MSG_SERVICE_ACCEPT received
debug1: Authentications that can continue: password
debug1: Next authentication method: password
root@10.10.1.183's password: 

换句话说，只有PasswordAuthenticationin 服务器sshd_config文件设置为yes.

根据RFC 4252第8节It is up to the server how to interpret the password and validate it against the password database.我是正确，在Linux中，这意味着sshd直接检查/etc/passwd和/etc/shadow文件，如果UsePAM在sshd配置被禁？

Answer 1

我是否正确，在 Linux 中这意味着如果 sshd 配置中的 UsePAM 被禁用，sshd 会直接检查 /etc/passwd 和 /etc/shadow 文件？

是的。但目前大多数发行版都使用 pam 处理登录，因为当今系统中的会话变得越来越复杂。OpenSSH 可以使用<shadow.h>头文件和其中定义的函数与影子通信。

有关更多信息，请参阅源代码文件auth.c和auth-shadow.c