I have learned a lot today messing around with ssh with RSA and creating system user accounts with no password, no login etc etc. What I was trying to do was create a user with a home directory needed for ~/.ssh/ and a password (needed for initial ssh setup)

But I can't seem to get it set-up correctly.

I know about using

ssh-copy-id user@remotehost

This is simple for RSA

and I know how to create a user with say

useradd -r newuser


adduser newuser --system --shell=/bin/false
passwd newuser
passwd -d newuser
  • The End Goal

    is a user who doesn't have a shell, or atleast can't be logged into from a remote computer, but can still be used to ssh over to another computer and run a command. Is this even possible?


    is to have a user whom when the ups runs low on power, shuts down the other connected computers via ssh before shutting down the main computer. (Only one computer can connect to the UPS via USB at a time to monitor the stats).

I don't want people to be able to log in via SSH with the username UPS, but I need ups to be able to ssh into remotehost without password.

  • Have you considered using a key instead of a password ? This would not require any password as is, only to have the private certificate on the client.
    – Zulgrib
    Commented Aug 17, 2016 at 21:30
  • ssh-keygen and ssh-copy-id is for generating RSA keys and replicating public key to remote host... The idea is that the USER just won't have a system password at all. Nor a login shell, just the ability to ssh via rsa and then run the command "shutdown -h now" Commented Aug 17, 2016 at 21:33

4 Answers 4


Set the crypt field to * or to !! in /etc/shadow


# adduser tst  
# passwd -l tst
Locking password for user tst.
passwd: Success
# grep tst /etc/passwd
# grep tst /etc/shadow

At this point the user can not login because there's no valid password.

Now add a command="/thing/to/do" to the beginning of the public key in the authorized_keys file


# ls -l $PWD/authorized_keys 
-rw-r--r-- 1 tst tst 431 Aug 17 17:54 /home/tst/.ssh/authorized_keys

# cat $PWD/authorized_keys
command="/bin/echo hello" ssh-rsa AAAAB3NzaC1yc2E....etcetc

Now this key can be used, but the only thing it can be used for is that forced command:

$ ssh -i ~/.ssh/id_rsa tst@test1
Connection to test1 closed.

If you try to do anything else it'll fail, and still force the same command

$ ssh -i ~/.ssh/id_rsa tst@test1 reboot 
  • This seems perfect! I've never herd of putting and command inside an Rsa key but that's perfect! I'll test then accept Commented Aug 17, 2016 at 22:41
  • I love how this locks it down, even if somebody got ahold of the key, and ssh'd in, they would just shut down the computer :P, works great! Commented Aug 18, 2016 at 16:58
  • 1
    You can also add a from="" entry to it to restict the IP address the key can be used from; if someone got the key and tried to use it from any other machine then it'd fail. Commented Aug 18, 2016 at 17:00
  • 1
    Yes, IP address patterns and DNS names can all be used. Commented Aug 18, 2016 at 17:10
  • 2
    usermod -p '*' user seems safer than editing /etc/shadow directly... Commented Nov 28, 2018 at 7:38

You can specify a forced command associated with a given public key in the authorized keys file. See the section 'AUTHORIZED_KEYS FILE FORMAT' of man sshd.

    Specifies that the command is executed whenever this key is used for authentication. The command supplied by the user (if any) is ignored....

You can also use the no-pty option on the key to disallow pty allocation.


You have create an account with nologin shell on that "main" machine. For that account you should generate ssh keys which can be used for remote login on machine which should be shutdown.

nologin shell will prevent login on that account, but it still can be used for remote login on other system.

To login as user with nologin shell you'll have to use su - user_name -s /bin/bash

My point is that the 'main' machine will automatically shutdown remote servers, without human interaction.

  • Doesn't the su command requires you to be logged to the remote machine first ?
    – Zulgrib
    Commented Aug 17, 2016 at 21:50
  • 1
    That's correct, but you can use root account for that purpose.
    – HubertS
    Commented Aug 17, 2016 at 22:06
  • This is a much cleaner solution imho.
    – Bevor
    Commented Oct 28, 2022 at 11:17

You can do it the other way around: setup a scheduled task to check if the machine connected by USB to the UPS is online from the machines that has to be shutdown, if the machine connected to the UPS is offline a certain number of time in a row. As the machine will use a local account to run the scheduled task, no password or certificate will be required to do the task. If the machine replies to pings, it could be as easy as checking if you get a reply from the ping.

Another method would be to use KVM to initiate the shutdown, as if the power button was pressed. Depending on the machine settings, pressing the power button will just initiate the normal shutdown operation, or put the machine to suspend to disk.

I don't know a method to log to a remote machine without some sort of authentification unless leaving an account open to the wind or using a security flaw, a backdoor.

While this is not the method you asked to do the task, it is a method that will work to get your goals accomplished.

  • That would definitely not work, way to high of a chance of a machine shooting itself in the head when there is no actual power outage, just some sort of network failure that would probably fix itself if left well alone. Commented Aug 18, 2016 at 13:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .