66

I want to add a user to Red Hat Linux that will not use a password for logging in, but instead use a public key for ssh. This would be on the command line.

4
  • useradd --password-disable and adduser --password disable. I've looked at the options for both and don't see password disable as an option for either.
    – user119776
    Jun 17, 2015 at 10:45
  • Do you know how to set up an ssh key login in general? I think the account just needs to not be locked, which would imply that there is some password active. It can be some long password that no one actually knows. Jun 17, 2015 at 10:53
  • I have the key and know that I need to create the folder under user's directory and paste public portion there. I can try that way, but thought that I needed to disable the user password too.
    – user119776
    Jun 17, 2015 at 10:56
  • Rather than make another post showing you how to add a user, I agree with Lambert. You need to focus specifically on the part of this task you are having trouble with. If you don't know how to even add a user, you should start small and work your way up. I believe you only need to create the user, don't set any password, and put their key in /home/username/.ssh/authorized_keys.
    – Baazigar
    Jun 17, 2015 at 18:06

4 Answers 4

77

Start with creating a user:

useradd -m -d /home/username -s /bin/bash username

Create a key pair from the client which you will use to ssh from:

ssh-keygen -t rsa

Copy the public key /home/username/.ssh/id_rsa.pub onto the RedHat host into /home/username/.ssh/authorized_keys

Set correct permissions on the files on the RedHat host:

chown -R username:username /home/username/.ssh
chmod 700 /home/username/.ssh
chmod 600 /home/username/.ssh/authorized_keys

Ensure that Public Key authentication is enabled on the RedHat host:

grep  PubkeyAuthentication /etc/ssh/sshd_config
#should output:
PubkeyAuthentication yes

If not, change that directive to yes and restart the sshd service on the RedHat host.

From the client start an ssh connection:

ssh username@redhathost

It should automatically look for the key id_rsa in ~/.ssh/. You can also specify an identity file using:

ssh -i ~/.ssh/id_rsa username@redhathost
4
  • 4
    Actually I did not forget about the password lock. Since I simply did not set it the password of the newly created user is automatically locked.
    – Lambert
    Jun 18, 2015 at 5:53
  • 9
    use RSA instead of DSA
    – s g
    Feb 5, 2018 at 21:41
  • 1
    you realize the "ssh-keygen -t dsa" command will create keys for the current user, it might replace your own keys
    – yarun can
    Jun 25, 2018 at 0:18
  • Use ssh-keygen -t ed25519 instead since this is the most recommended public-key algorithm available today May 24 at 8:41
29

On Ubuntu you can add the user with:

adduser --disabled-password <username>

Then create .ssh/authorized_keys file in their home directory with their public key.

12

You could use:

usermod --lock <username>

From the man page:

Lock a user's password. This puts a '!' in front of the encrypted password, effectively disabling the password. You can't use this option with -p or -U. Note: if you wish to lock the account (not only access with a password), you should also set the EXPIRE_DATE to 1.

0

Complete script (<SSH_PUB_KEY> is in format of ssh-rsa …):

NEW_USER=newuser

sudo adduser --disabled-password $NEW_USER
sudo su - $NEW_USER

# now you are under the new user's shell
mkdir -p .ssh
chmod 0700 .ssh
echo "<SSH_PUB_KEY>" > .ssh/authorized_keys
chmod 644 .ssh/authorized_keys

I was looking for a script that I can fearlessly run creating a new user with proper SSH permissions, so if you do too, I believe this should help you :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.