I configure ssh authorization to drop some users with rules, defined in script, and also give them some extended capabilities when they login. I use two pam modules - pam_script and pam_cap and change sshd pam config (/etc/pam.d/sshd) so it looks like that (only first two lines are custom):
#%PAM-1.0 auth required pam_script.so auth required pam_cap.so auth required pam_sepermit.so auth substack password-auth auth include postlogin # Used with polkit to reauthorize users in remote sessions -auth optional pam_reauthorize.so prepare account required pam_nologin.so account include password-auth password include password-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_loginuid.so # pam_selinux.so open should only be followed by sessions to be executed in the user context session required pam_selinux.so open env_params session required pam_namespace.so session optional pam_keyinit.so force revoke session include password-auth session include postlogin # Used with polkit to reauthorize users in remote sessions -session optional pam_reauthorize.so prepare
Password authentication is allowed, and now user can authorize through Pkey or password. If user authorizes through password, pam_script works well, and those users who doesn't stand rules are dropped. But, if same user authorizes through Pkey, then pam auth section seems to be bypassed, pam_script is not invoked at all. Doesn't sshd use pam auth when authorizing users with Pkey?