Forced user password change when login over SSH

Question

I'm planning a setup wherein users can only login to a machine via SSH, but will need their password for sudo commands (to avoid accidents so that there is a 'sanity check' prompt for a password, and to avoid compromised accounts such that even if someone fudges their way in with your pub-priv key, there's an extra challenge on root commands).

Can I force a user to change their password when they first login (using a pub key) via SSH?

I know I can use chage but I assume this is for physical logins and not remote logins.

Answer 1

The fact that you are using pubkey authentication to log in via SSH has nothing to do with their password. You are just configuring the ssh service to accept only that auth method.

You can set their password expiration days to 0 with chage -d 0 [LOGIN] and the next time they log in they will be forced to change the password.

BEWARE the first thing they will be asked when they connect through SSH will be their current password, then they can set up a new password. If there is no password set up for that user or they don't know it you have left them locked out of the system. An incorrect response to (current) UNIX password: will disconnect them immediately, and if they connect again they will be prompted that again.