How to allow unauthenticated logins over ssh on FreeBSD?

Question

I created an account ckurs on my FreeBSD 10 workstation. This account uses a custom shell-script as a login-shell that attaches the user to a tmux-session in read-only mode. I have sufficiently convinced myself that this is safe.

I would like to give others the ability to login to the user ckurs without providing any form of authentication (no password, no keys, nothing). In the past, I set a simple password for this account but getting users to type that in correctly always caused a little kerfuffle, so I'd like to avoid that.

I started by setting a blank password with pw usermod ckurs -w none. This works for local logins and su but not when I log in via ssh, instead, authentication is refused after prompting for a password three times.

What option do I need to set where in order to allow login without a password? Best would be a configuration that only applied to that one account.

I believe I have not changed any configuration regarding authentication on the system, I believe the system uses PAM to authenticate users by default (I'm not sure though), the PAM configuration hasn't been changed from the defaults delivered by FreeBSD 10.

Answer 1

To allow unauthenticated login over SSH using PAM, all of the following must be configured:

• The user account must have “no password” set. This is different from “empty password” and can be achieved with

  pw usermod <user> -w none
  

• In sshd_config, the following option must be set before UsePAM is set, otherwise the option is ignored:

  PermitEmptyPasswords yes
  

• In the PAM configuration file for sshd, the pam_unix module in the auth category must be loaded with the nullok option, e. g.

  auth        required    pam_unix.so     no_warn try_first_pass nullok