Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I create a new user account I ask users to send me a public key, and want to force users to set the password the first time they log in with keypair authentication. If I create an account with an impossible/disabled and expired password, but put a pubkey in their .ssh/authorized_keys file, the user is required to change his password at first login, but cannot enter his current one!

# adduser --disabled-password foo
# chage -d0 foo

What is a more appropriate way to go about this?

share|improve this question
If you pre-install a key for them, what's the point of ever using ChallengeResponseAuthentication? Any subsequent login will prefer the key. – bahamat Oct 12 '12 at 17:49
@bahamat true, but the challenge-response thing was a tangential distraction. I've removed it from the question. – kojiro Oct 12 '12 at 20:16
up vote 2 down vote accepted

You could

  1. Make sure nullok or nullok_secure is not in use in arguments of pam_unix for auth in the pam configuration for any service.
  2. passwd -d foo
  3. chage -d0 foo

That seems to do the trick here (debian wheezy).

share|improve this answer
The two commands must be executed in the reverse order. Otherwise a good answer. – Flavius Jul 31 '15 at 9:33
@Flavius, what system? That order works for me on Debian with version 4.2 of shadow utilities – Stéphane Chazelas Jul 31 '15 at 11:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.