If user's password has/was expired (e.g. with passwd --expire username) - sftp will fail to login to the ssh server, saying: Connection closed If the same user tries to connect using ssh - it prompts him to change the expired password. I think sftp should behave the same way and prompt user to change the expired password. Thank you!
The mechanism sshd currently uses to perform the password change is to exec /bin/passwd on the tty of the logged in user. An sftp conection has no pty on the server side, so that's not possible in that case. The reasons it's done that way are complicated, I will elaborate over on bug #2796.
That said, there is one existing mechanism that should work in that case UsePAM=yes plus ChallengeResponseAuthentication=yes. That will call pam_chauthtok() with a conversation function that can interact with the ssh clinet via the keyboard-interactive SSH auth method.
There's not much we can do for this specific case other than keyboard-interactive/pam, which already exists. I'm closing this bug but I'll keep #2796 open in case a suitable interface does become available.
closing resolved bugs as of 8.6p1 release