Force pubkey-auth user to set password at first login

Question

When I create a new user account I ask users to send me a public key, and want to force users to set the password the first time they log in with keypair authentication. If I create an account with an impossible/disabled and expired password, but put a pubkey in their .ssh/authorized_keys file, the user is required to change his password at first login, but cannot enter his current one!

# adduser --disabled-password foo
…
# chage -d0 foo

What is a more appropriate way to go about this?

Answer 1

You could

1. Make sure nullok or nullok_secure is not in use in arguments of pam_unix for auth in the pam configuration for any service.
2. passwd -d foo
3. chage -d0 foo

That seems to do the trick here (debian wheezy).