From 05059810d35f1f2eb198652acbe3e6e72d6213e4 Mon Sep 17 00:00:00 2001
From: dtucker <dtucker>
Date: Thu, 23 Feb 2006 10:35:30 +0000
Subject: [PATCH]  - (dtucker) [sshd_config sshd_config.5] Update UsePAM to
 reflect current    reality.  Pointed out by tryponraj at gmail.com.

---
 ChangeLog     |  4 ++++
 sshd_config   | 13 +++++++------
 sshd_config.5 |  5 ++++-
 3 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 1e47fa35..30859bf1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+2006023
+ - (dtucker) [sshd_config sshd_config.5] Update UsePAM to reflect current
+   reality.  Pointed out by tryponraj at gmail.com.
+
 2006022
  - (dtucker) [openbsd-compat/openssl-compat.{c,h}] Minor tidy up: only
    compile in compat code if required.
diff --git a/sshd_config b/sshd_config
index 4957dd1a..57f9a17b 100644
--- a/sshd_config
+++ b/sshd_config
@@ -71,12 +71,13 @@
 
 # Set this to 'yes' to enable PAM authentication, account processing, 
 # and session processing. If this is enabled, PAM authentication will 
-# be allowed through the ChallengeResponseAuthentication mechanism. 
-# Depending on your PAM configuration, this may bypass the setting of 
-# PasswordAuthentication, PermitEmptyPasswords, and 
-# "PermitRootLogin without-password". If you just want the PAM account and 
-# session checks to run without PAM authentication, then enable this but set 
-# ChallengeResponseAuthentication=no
+# be allowed through the ChallengeResponseAuthentication and
+# PasswordAuthentication.  Depending on your PAM configuration,
+# PAM authentication via ChallengeResponseAuthentication may bypass
+# the setting of "PermitRootLogin without-password".
+# If you just want the PAM account and session checks to run without
+# PAM authentication, then enable this but set PasswordAuthentication
+# and ChallengeResponseAuthentication to 'no'.
 #UsePAM no
 
 #AllowTcpForwarding yes
diff --git a/sshd_config.5 b/sshd_config.5
index 71a293ff..6e2de10d 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -677,7 +677,10 @@ If set to
 .Dq yes
 this will enable PAM authentication using
 .Cm ChallengeResponseAuthentication
-and PAM account and session module processing for all authentication types.
+and
+.Cm PasswordAuthentication
+in addition to PAM account and session module processing for all
+authentication types.
 .Pp
 Because PAM challenge-response authentication usually serves an equivalent
 role to password authentication, you should disable either
-- 
2.45.1