I'm planning a setup wherein users can only login to a machine via SSH, but will need their password for sudo commands (to avoid accidents so that there is a 'sanity check' prompt for a password, and to avoid compromised accounts such that even if someone fudges their way in with your pub-priv key, there's an extra challenge on root commands).

Can I force a user to change their password when they first login (using a pub key) via SSH?

I know I can use chage but I assume this is for physical logins and not remote logins.

1 Answer 1


The fact that you are using pubkey authentication to log in via SSH has nothing to do with their password. You are just configuring the ssh service to accept only that auth method.

You can set their password expiration days to 0 with chage -d 0 [LOGIN] and the next time they log in they will be forced to change the password.

BEWARE the first thing they will be asked when they connect through SSH will be their current password, then they can set up a new password. If there is no password set up for that user or they don't know it you have left them locked out of the system. An incorrect response to (current) UNIX password: will disconnect them immediately, and if they connect again they will be prompted that again.

  • Ah that kind of fudges my plans a little. My plan was to create them with a blank password and forced a change once logged in. I think I can work around this, though and it would be little inconvenience on the first login only. Commented Mar 13, 2018 at 16:25
  • But, basically, if they login with SSH, it's still a "login" and they'll be prompted for a change? If so, excellent :) Commented Mar 13, 2018 at 16:25
  • 1
    That's correct, if they login they are prompted for a change, no matter what authentication method they used for SSH
    – Tux
    Commented Mar 13, 2018 at 16:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .