diff --git a/molecule/os_hardening/verify.yml b/molecule/os_hardening/verify.yml
index 5717e604..287f5423 100644
--- a/molecule/os_hardening/verify.yml
+++ b/molecule/os_hardening/verify.yml
@@ -20,6 +20,7 @@
         - verify_tasks/pw_ageing.yml
         - verify_tasks/netrc.yml
         - verify_tasks/ignore_home_folders.yml
+        - verify_tasks/ssh_auth_locked.yml
 
     # temp. disabled - https://github.com/dev-sec/ansible-collection-hardening/issues/690
     #    - name: Include PAM tests
diff --git a/molecule/os_hardening/verify_tasks/ssh_auth_locked.yml b/molecule/os_hardening/verify_tasks/ssh_auth_locked.yml
new file mode 100644
index 00000000..f15a0254
--- /dev/null
+++ b/molecule/os_hardening/verify_tasks/ssh_auth_locked.yml
@@ -0,0 +1,57 @@
+---
+- name: Install sshpass
+  package:
+    name:
+      - sshpass
+    state: present
+
+- name: Set password for test
+  ansible.builtin.set_fact:
+    test_pw: myTest!pw
+
+- name: Create locked_user
+  user:
+    name: locked_user
+    password: "{{ test_pw | password_hash('sha512') }}"
+
+- name: Create ssh-client-keypair
+  community.crypto.openssh_keypair:
+    path: /root/.ssh/locked_user_id
+    type: ed25519
+    state: present
+  register: generated_key
+
+- name: Add ssh-public-key to locked_user
+  ansible.posix.authorized_key:
+    user: locked_user
+    key: "{{ generated_key.public_key }}"
+    state: present
+
+- name: Check successful login with password
+  ansible.builtin.shell:
+    cmd: sshpass -p {{ test_pw }} ssh locked_user@localhost echo "success"
+
+- name: Check successful login with ssh key
+  ansible.builtin.shell:
+    cmd: ssh -i /root/.ssh/locked_user_id locked_user@localhost echo "success"
+
+- name: Set password change date for locked_user
+  ansible.builtin.shell:
+    cmd: chage -d 2020-01-01 locked_user
+
+- name: Check unsuccessful login with password
+  ansible.builtin.shell:
+    cmd: sshpass -p {{ test_pw }} ssh locked_user@localhost echo "success"
+  register: output
+  ignore_errors: true
+
+- name: Assert check unsuccessful login
+  ansible.builtin.assert:
+    that:
+      - output.rc | int == 1
+      - "'WARNING: Your password has expired.' in output.stderr"
+      - "'success' not in output.stdout"
+
+- name: Check successful login with ssh key
+  ansible.builtin.shell:
+    cmd: ssh -i /root/.ssh/locked_user_id locked_user@localhost echo "success"
diff --git a/roles/os_hardening/tasks/pam_debian.yml b/roles/os_hardening/tasks/pam_debian.yml
index f49de474..3309bc90 100644
--- a/roles/os_hardening/tasks/pam_debian.yml
+++ b/roles/os_hardening/tasks/pam_debian.yml
@@ -118,3 +118,10 @@
     state: absent
   when:
     - not os_auth_pam_passwdqc_enable
+
+- name: Allow Login with SSH Keys, when user password is expired
+  lineinfile:
+    path: /etc/pam.d/common-account
+    backrefs: yes
+    regexp: "^(account.*pam_unix.so(?!.*no_pass_expiry).*)$"
+    line: '\1 no_pass_expiry'
diff --git a/roles/os_hardening/templates/etc/pam.d/rhel_auth.j2 b/roles/os_hardening/templates/etc/pam.d/rhel_auth.j2
index 3d7cd224..0bdd1779 100644
--- a/roles/os_hardening/templates/etc/pam.d/rhel_auth.j2
+++ b/roles/os_hardening/templates/etc/pam.d/rhel_auth.j2
@@ -24,7 +24,7 @@ auth        required      pam_deny.so
 {% if os_auth_retries|int > 0 %}
 account     required      pam_faillock.so
 {% endif %}
-account     required      pam_unix.so
+account     required      pam_unix.so no_pass_expiry
 account     sufficient    pam_localuser.so
 account     sufficient    pam_succeed_if.so uid < 1000 quiet
 {% if (os_auth_pam_sssd_enable | bool) %}