3

We want to remove the password usage on a UNIX system.
The users should only log in with SSH key. Not password.
So their password field in the /etc/shadow file will be "*" and set their password to never expire. (because if sshd_config has UsePAM yes and the password that doesn't exists expires.. that means the user cannot input the old password after the pwd expires..)

The question: doing this is safe? The only problem we can see that if a user has sudo permissions for a command, then it will need to have the "NOPASSWD" set in sudo, since the users pwd has to be given if using sudo

What other problems could be there (that the users pwd is "*")?

  • Yes, it should be safe, as long as you set a disabled password (e.g. with passwd -l). Do not delete the password (passwd -d) because that may allow the user to login without a password. But on the other hand, you don't really gain any security - just configure your SSH server so that it only accepts SSH keys. sudo without passwords is IMO not an improvement. – Martin von Wittich Oct 19 '14 at 9:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.