I want to add a user to Red Hat Linux that will not use a password for logging in, but instead use a public key for ssh. This would be on the command line.
-
useradd --password-disable and adduser --password disable. I've looked at the options for both and don't see password disable as an option for either. – user119776 Jun 17 '15 at 10:45
-
Do you know how to set up an ssh key login in general? I think the account just needs to not be locked, which would imply that there is some password active. It can be some long password that no one actually knows. – Micah Yoder Jun 17 '15 at 10:53
-
I have the key and know that I need to create the folder under user's directory and paste public portion there. I can try that way, but thought that I needed to disable the user password too. – user119776 Jun 17 '15 at 10:56
-
Rather than make another post showing you how to add a user, I agree with Lambert. You need to focus specifically on the part of this task you are having trouble with. If you don't know how to even add a user, you should start small and work your way up. I believe you only need to create the user, don't set any password, and put their key in /home/username/.ssh/authorized_keys. – Baazigar Jun 17 '15 at 18:06
Start with creating a user:
useradd -m -d /home/username -s /bin/bash username
Create a key pair from the client which you will use to ssh from:
ssh-keygen -t dsa
Copy the public key /home/username/.ssh/id_dsa.pub onto the RedHat host into /home/username/.ssh/authorized_keys
Set correct permissions on the files on the RedHat host:
chown -R username:username /home/username/.ssh
chmod 700 /home/username/.ssh
chmod 600 /home/username/.ssh/authorized_keys
Ensure that Public Key authentication is enabled on the RedHat host:
grep PubkeyAuthentication /etc/ssh/sshd_config
#should output:
PubkeyAuthentication yes
If not, change that directive to yes and restart the sshd service on the RedHat host.
From the client start an ssh connection:
ssh username@redhathost
It should automatically look for the key id_dsa in ~/.ssh/. You can also specify an identity file using:
ssh -i ~/.ssh/id_dsa username@redhathost
-
3Actually I did not forget about the password lock. Since I simply did not set it the password of the newly created user is automatically locked. – Lambert Jun 18 '15 at 5:53
-
3
-
you realize the "ssh-keygen -t dsa" command will create keys for the current user, it might replace your own keys – yarun can Jun 25 '18 at 0:18
On Ubuntu you can add the user with:
adduser --disabled-password <username>
Then create .ssh/authorized_keys file in their home directory with their public key.
You could use:
usermod --lock <username>
From the man page:
Lock a user's password. This puts a '!' in front of the encrypted password, effectively disabling the password. You can't use this option with -p or -U. Note: if you wish to lock the account (not only access with a password), you should also set the EXPIRE_DATE to 1.
