Enforce Expiration Dates¶

This is to be done on the login node — compute nodes should already deny SSH entirely (see SSH Access Control).

Update /etc/pam.d/common-account to enable shadow expiration checking:

sudo nano /etc/pam.d/common-account

Change this line:

account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so

To this:

account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so shadow

Edit the SSSD configuration file:

sudo nano /etc/sssd/sssd.conf

Add these parameters to your [domain/example] section:

ldap_account_expire_policy = shadow
ldap_pwd_policy = shadow
ldap_access_order = expire
ldap_user_shadow_last_change = shadowLastChange
ldap_user_shadow_expire = shadowExpire