When the password is locked or expired, root put a ! sign before the password & when the user tries to log in. Its hashed provided password doesnt match with its password because a ! before password does not match.
While unlocking root user deletes the ! sign before the password so password entries are matched & user is able to login.
Now considering your situation.
- User is locked or expired
- User tries to login with terminal and blocked because password provided does not match with password database.
- When he tries login with ssh-keys. It logs im.
debug3: authmethod_lookup publickey
debug3: remaining preferred: keyboard-interactive,password
debug3: authmethod_is_enabled publickey
debug1: Next authentication method: publickey
debug1: Offering public key: firstname.lastname@example.org
debug2: we sent a publickey packet, wait for reply
debug3: Wrote 528 bytes for a total of 1637
debug1: Authentications that can continue: publickey,gssapi-with-mic,password
debug1: Trying private key: /home/atolani/.ssh/identity
debug3: no such identity: /home/atolani/.ssh/identity
debug1: Trying private key: /home/atolani/.ssh/id_rsa
debug3: no such identity: /home/atolani/.ssh/id_rsa
debug1: Trying private key: /home/atolani/.ssh/id_dsa
debug3: no such identity: /home/atolani/.ssh/id_dsa
debug2: we did not send a packet, disable method
debug3: authmethod_lookup password
debug3: remaining preferred: ,password
debug3: authmethod_is_enabled password
debug1: Next authentication method: password
Given is the verbose output of ssh login.
By this we can see, that a ssh login initially try to check identity private keys & move to interactive password when above in unavailable. This shows that while logging using ssh-keys user does not check the password so is unable to check whether the password is locked or not.
So yes, If your password is expired or locked, You will be able to login if password keys are configured.