Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

When I create a new user account I ask users to send me a public key, and want to force users to set the password the first time they log in with keypair authentication. If I create an account with an impossible/disabled and expired password, but put a pubkey in their .ssh/authorized_keys file, the user is required to change his password at first login, but cannot enter his current one!

# adduser --disabled-password foo
…
# chage -d0 foo

What is a more appropriate way to go about this?

share|improve this question
1  
If you pre-install a key for them, what's the point of ever using ChallengeResponseAuthentication? Any subsequent login will prefer the key. –  bahamat Oct 12 '12 at 17:49
    
@bahamat true, but the challenge-response thing was a tangential distraction. I've removed it from the question. –  kojiro Oct 12 '12 at 20:16

1 Answer 1

You could

  1. Make sure nullok or nullok_secure is not in use in arguments of pam_unix for auth in the pam configuration for any service.
  2. passwd -d foo
  3. chage -d0 foo

That seems to do the trick here (debian wheezy).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.