Merge pull request #33 from TelekomLabs/locked-accounts

improvement: added faq on locked accounts to readme

README.md

@@ -94,6 +94,24 @@ bundle exec kitchen test default-ubuntu-1204
 
 For more information see [test-kitchen](http://kitchen.ci/docs/getting-started)
 
+## FAQ / Pitfalls
+
+**I can't log into my account. I have registered the client key, but it still doesn't let me it.**
+
+If you have exhausted all typical issues (firewall, network, key missing, wrong key, account disabled etc.), it may be that your account is locked. The quickest way to find out is to look at the password hash for your user:
+
+    sudo grep myuser /etc/shadow
+
+If the hash includes an `!`, your account is locked:
+
+    myuser:!:16280:7:60:7:::
+
+The proper way to solve this is to unlock the account (`passwd -u myuser`). If the user doesn't have a password, you should can unlock it via:
+
+    usermod -p "*" myuser
+
+Alternatively, if you intend to use PAM, you enabled it via `['ssh']['use_pam'] = true`. PAM will allow locked users to get in with keys.
+
 ## Contributors + Kudos
 
 * Dominik Richter