Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 5 down vote favorite

I would like to create a user and have no password. As in you cant log in with a password. I want to add keys to its authorized_keys by using root. This is for my automated backup system.

share|improve this question

3 Answers

up vote 10 down vote accepted

Use of passwd -d is plain wrong , at least on Fedora, on any linux distro based on shadow-utils. If you remove the password with passwd -d, it means anyone can login to that user (on console or graphical) providing no password.

In order to block logins with password authentication, run passwd -l username, which locks the account making it available to the root user only. The locking is performed by rendering the encrypted password into an invalid string (by prefixing the encrypted string with an !).

Any login attempt, local or remote, will result in an "incorrect password", while public key login will still be working. The account can then be unlocked with passwd -u username.

If you want to completely lock an account without deleting it, edit /etc/passwd and set /sbin/nologin or /bin/false in the last field. This will result in "This account is currently not available." for any login attemp.

Please refer to passwd(1) man page.

share|improve this answer
@guido: rvs won't be notified of your answer. You would need to add a comment to his answer for that (I've done it). Note that readers may read your answer before his, you should write answers that respond directly to the question. Well done for pointing this one out! It applies to most Linux distributions (the ones using the Linux shadow utilities). – Gilles Feb 18 '11 at 22:39
@Gilles: sorry i am new to stackexchange; i only pointed out this one a bit hardly because it was like suggesting users to setup passwordless accounts, and it was accepted and marked as useful... – guido Feb 18 '11 at 22:42
@guido: No worries, I was just explaining how to make your warning more effective. In fact, in such extreme cases where an answer is dangerously wrong, it would be appropriate to suggest an edit adding a warning or correction (hopefully you won't encounter these situations too often on the site). – Gilles Feb 18 '11 at 22:58
@guido: Actually, on debian Squeeze (i dont know about lenny or etch) that answer DOES work. It doesnt allow anyone but root to log in, allows authorize keys but it isnt password less, it just accepts no password. I was surpised you could 'delete the password' and that it would work this way. But it did exactly what i wanted and exactly what this answer does and was the only answer so i just accepted it. This answer makes more sense and i'll accept it because i'm willing to bet other distos does allow anyone to login bc its passwordless unlike debian. Anyways good answer. – acidzombie24 Feb 20 '11 at 2:05
1  
@acidzombie24, @mattdn: they could have removed nullok from pam.d/password-auth if debian uses pam (i think so, but i am not a debian expert). However, passwd(1) manpage cleary states that -d argument is to create passwordless accounts, so any distro-specific speculation here is secondary, as the question was very general. – guido Feb 20 '11 at 22:00
show 3 more comments
up vote 1 down vote

Just don't set password for user. If there is already a password remove it by using passwd -l <username>.

But it would be still possible to log in as this user - by using authorized_keys, or via su or sudo from some privileged account.

share|improve this answer
1  
As pointed out by guido, passwd -d makes the account passwordless, as in, you can log in without having to type a password. Use passwd -l to lock the account (think of it as giving an impossible-to-type password). – Gilles Feb 18 '11 at 22:34
I've added a warning to your post, because it is dangerous as it stands. I'll leave it up to you to decide whether to fix your answer, or delete your answer (if you think guido's is sufficient), or refute the warning. – Gilles Feb 18 '11 at 22:37
Why oh why do people accept the answer that doesn't even work? – mathepic Feb 18 '11 at 23:47
@mathepic: It does work, on debian. Exactly the way i asked – acidzombie24 Feb 19 '11 at 1:14
are you sure that a non-privileged user can't su to the user? – mattdm♦ Feb 20 '11 at 15:47
up vote 1 down vote

Are not you asking specific to SSH daemon, not to accept the password based authentication but the key/passphrase authentication?

Look for changes to sshd_config.

Set

PasswordAuthentication No

PreferredAuthentications publickey,hostbased,keyboard-interactive

Protocol 2,1

Look for more config parameters at http://www.openbsd.org/cgi-bin/man.cgi?query=ssh_config&apropos=0&sektion=0&manpath=OpenBSD+Current&arch=i386&format=html

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.