- (dtucker) [sshd.8] Bug #843: Add warning about PasswordAuthentication to

UsePAM section.  Parts from djm@ and jmc@.

ChangeLog

@@ -34,6 +34,8 @@
    - dtucker@cvs.openbsd.org 2004/05/13 02:47:50
      [ssh-agent.1]
      Add examples to ssh-agent.1, bz#481 from Ralf Hauser; ok deraadt@
+ - (dtucker) [sshd.8] Bug #843: Add warning about PasswordAuthentication to
+   UsePAM section.  Parts from djm@ and jmc@.
 
 20040502
  - (dtucker) OpenBSD CVS Sync
@@ -1110,4 +1112,4 @@
    - (djm) Trim deprecated options from INSTALL. Mention UsePAM
    - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu
 
-$Id: ChangeLog,v 1.3351 2004/05/13 06:45:46 dtucker Exp $
+$Id: ChangeLog,v 1.3352 2004/05/13 06:51:40 dtucker Exp $

sshd_config.5

@@ -624,12 +624,25 @@ If
 .Cm UsePrivilegeSeparation
 is specified, it will be disabled after authentication.
 .It Cm UsePAM
-Enables PAM authentication (via challenge-response) and session set up.
+Enables the Pluggable Authentication Module interface.
-If you enable this, you should probably disable
+If set to
-.Cm PasswordAuthentication .
+.Dq yes
-If you enable
+this will enable PAM authentication using
-.CM UsePAM
+.Cm ChallengeResponseAuthentication
-then you will not be able to run sshd as a non-root user.  The default is
+and PAM account and session module processing for all authentication types.
+.Pp
+Because PAM challenge-response authentication usually serves an equivalent
+role to password authentication, you should disable either
+.Cm PasswordAuthentication
+or
+.Cm ChallengeResponseAuthentication.
+.Pp
+If
+.Cm UsePAM
+is enabled, you will not be able to run
+.Xr sshd 8
+as a non-root user.
+The default is
 .Dq no .
 .It Cm UsePrivilegeSeparation
 Specifies whether