When a user account is in change password in next login or password has expired, the user is not being prompted to re-enter his new password; instead they get an access denied message.
1 - Edit the sshd_config file and set ChallengeResponseAuthentication to yse
It should look like this:
This will enable the interactive mode and prompt the user for his password.
2 - Restart sshd