pam.d/sshd config for passwd expiration
 

I'm trying to make ssh login force the user to change his password when the password expired. I got the prompt to enter current password, but the new password was never successfully changed.

The console log is:
->ssh sshuser@xx.xx.xx.xx
Password: => I entered current password here
You are required to change your password immediately (root enforced)
Changing password for sshuser
(current) UNIX password: => I entered current password here
Password unchanged

Password: => I entered current password here
You are required to change your password immediately (root enforced)
Changing password for sshuser
(current) UNIX password: => I entered new password
Password: => I entered new password
Permission denied (publickey,keyboard-interactive).


Is this controlled by pam.d/sshd configuration? Is anything wrong with my config file?

my sshd is:
# Begin /etc/pam.d/sshd

auth required pam_stack.so service=system-auth
auth required pam_nologin.so
account required pam_stack.so service=system-auth
password required pam_stack.so service=system-auth
session required pam_stack.so service=system-auth
session required pam_limits.so
session optional pam_console.so

# End /etc/pam.d/sshd

Thanks.

Config looks OK. As you see most of the PAM stack is in /etc/pam.d/system-auth, look there. Also the logs may show PAM-related info or warnings.

I modified system-auth, now it works. Thanks.

So, what did you modify?