I want to add a user to Red Hat Linux that will not use a password for logging in, but instead use a public key for ssh. This would be on the command line.
-
useradd --password-disable and adduser --password disable. I've looked at the options for both and don't see password disable as an option for either.– user119776Jun 17, 2015 at 10:45
-
Do you know how to set up an ssh key login in general? I think the account just needs to not be locked, which would imply that there is some password active. It can be some long password that no one actually knows.– Micah YoderJun 17, 2015 at 10:53
-
I have the key and know that I need to create the folder under user's directory and paste public portion there. I can try that way, but thought that I needed to disable the user password too.– user119776Jun 17, 2015 at 10:56
-
Rather than make another post showing you how to add a user, I agree with Lambert. You need to focus specifically on the part of this task you are having trouble with. If you don't know how to even add a user, you should start small and work your way up. I believe you only need to create the user, don't set any password, and put their key in /home/username/.ssh/authorized_keys.– BaazigarJun 17, 2015 at 18:06
Add a comment
|
4 Answers
Start with creating a user:
useradd -m -d /home/username -s /bin/bash username
Create a key pair from the client which you will use to ssh from:
ssh-keygen -t rsa
Copy the public key /home/username/.ssh/id_rsa.pub onto the RedHat host into /home/username/.ssh/authorized_keys
Set correct permissions on the files on the RedHat host:
chown -R username:username /home/username/.ssh
chmod 700 /home/username/.ssh
chmod 600 /home/username/.ssh/authorized_keys
Ensure that Public Key authentication is enabled on the RedHat host:
grep PubkeyAuthentication /etc/ssh/sshd_config
#should output:
PubkeyAuthentication yes
If not, change that directive to yes and restart the sshd service on the RedHat host.
From the client start an ssh connection:
ssh username@redhathost
It should automatically look for the key id_rsa in ~/.ssh/. You can also specify an identity file using:
ssh -i ~/.ssh/id_rsa username@redhathost
-
5Actually I did not forget about the password lock. Since I simply did not set it the password of the newly created user is automatically locked.– LambertJun 18, 2015 at 5:53
-
9
-
1you realize the "ssh-keygen -t dsa" command will create keys for the current user, it might replace your own keys Jun 25, 2018 at 0:18
-
2Use
ssh-keygen -t ed25519instead since this is the most recommended public-key algorithm available today May 24, 2022 at 8:41 -
1I make a mistake of thinking "into
authorized_keys" meant thatauthorized_keyswas a folder. It's actually a file! Hopefully this helps someone. Oct 14, 2022 at 4:05
On Ubuntu you can add the user with:
adduser --disabled-password <username>
Then create .ssh/authorized_keys file in their home directory with their public key.
You could use:
usermod --lock <username>
From the man page:
Lock a user's password. This puts a '!' in front of the encrypted password, effectively disabling the password. You can't use this option with -p or -U. Note: if you wish to lock the account (not only access with a password), you should also set the EXPIRE_DATE to 1.
Complete script (<SSH_PUB_KEY> is in format of ssh-rsa …):
NEW_USER=newuser
sudo adduser --disabled-password "$NEW_USER"
sudo -i -u "$NEW_USER"
# now you are under the new user's shell
cd
mkdir -p .ssh
chmod 0700 .ssh
echo "<SSH_PUB_KEY>" > .ssh/authorized_keys
chmod 600 .ssh/authorized_keys
I was looking for a script that I can fearlessly run creating a new user with proper SSH permissions, so if you do too, I believe this should help you :)
