4

I created an account ckurs on my FreeBSD 10 workstation. This account uses a custom shell-script as a login-shell that attaches the user to a tmux-session in read-only mode. I have sufficiently convinced myself that this is safe.

I would like to give others the ability to login to the user ckurs without providing any form of authentication (no password, no keys, nothing). In the past, I set a simple password for this account but getting users to type that in correctly always caused a little kerfuffle, so I'd like to avoid that.

I started by setting a blank password with pw usermod ckurs -w none. This works for local logins and su but not when I log in via ssh, instead, authentication is refused after prompting for a password three times.

What option do I need to set where in order to allow login without a password? Best would be a configuration that only applied to that one account.

I believe I have not changed any configuration regarding authentication on the system, I believe the system uses PAM to authenticate users by default (I'm not sure though), the PAM configuration hasn't been changed from the defaults delivered by FreeBSD 10.

1 Answer 1

6

To allow unauthenticated login over SSH using PAM, all of the following must be configured:

  • The user account must have “no password” set. This is different from “empty password” and can be achieved with

    pw usermod <user> -w none
    
  • In sshd_config, the following option must be set before UsePAM is set, otherwise the option is ignored:

    PermitEmptyPasswords yes
    
  • In the PAM configuration file for sshd, the pam_unix module in the auth category must be loaded with the nullok option, e. g.

    auth        required    pam_unix.so     no_warn try_first_pass nullok
    

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .