Locking account password and instead use RSA key

Question

Setting up a CentOS 7 cloud server for a client, and have run into an issue with setting it to use a public RSA key instead of a password for one of a handful of SFTP users.

Found an online guide on setting up keys at:

https://debian-administration.org/article/530/SSH_with_authentication_key_instead_of_password

The client supplied a public key file, which I copied to the server using the "ssh-copy-id" command. All good according to the responses I got.

I then locked the account using the "passwd -l" command. Reset the server and checked, and the system confirms that the password is locked:

testuser1 LK 2018-09-17 0 99999 7 -1 (Password locked.)

However, I can still log in using a password using that account on computers that do not have the private key installed.

So, I did more research, and found another tutorial that says you can force the use of RSA keys by setting PasswordAuthentication to no in the etc/ssh/sshd_config file, which raises a concern as other users do not use RSA keys for their login.

Did I do something wrong, or is there something else I can do to disable passwords for this single account? Is there a way to allow some users to use passwords while allowing others to use a RSA key?

Answer 1

After spinning up a brand-new CentOS instance in AWS, I went through the process of:

1. Adding a new user (and setting a password)
2. Test password login
3. Lock account
4. Test password login
5. Add ssh key to user's account
6. Test ssh key login

---

1. Add new user:

   [centos@ip-172-31-80-91 ~]$ sudo useradd -c "Demo User" -m demo_user
   [centos@ip-172-31-80-91 ~]$ sudo passwd demo_user
   Changing password for user demo_user.
   New password:
   Retype new password:
   passwd: all authentication tokens updated successfully.
   

2. Test password login:

   [guzzijason@macbook ]$ ssh demo_user@54.147.127.91
   demo_user@54.147.127.91's password:
   [demo_user@ip-172-31-80-91 ~]$
   

3. Lock account on server

   [centos@ip-172-31-80-91 ~]$ sudo passwd -l demo_user
   Locking password for user demo_user.
   passwd: Success
   

4. Test password login (again; should fail this time)

   [guzzijason@macbook ]$ ssh demo_user@54.147.127.91
   demo_user@54.147.127.91's password:
   Permission denied, please try again.
   demo_user@54.147.127.91's password:
   Permission denied, please try again.
   demo_user@54.147.127.91's password:
   demo_user@54.147.127.91: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
   

5. Add ssh key to user's account on server:

   [centos@ip-172-31-80-91 ~]$ sudo su -
   Last login: Mon Sep 17 22:07:43 UTC 2018 on pts/0
   [root@ip-172-31-80-91 ~]# umask 077
   [root@ip-172-31-80-91 ~]# mkdir /home/demo_user/.ssh
   [root@ip-172-31-80-91 ~]# echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDT+PautYetQxI+J8jshx2bZkMyuxd7dHBlCKjgIr9Y869RP+xzgvFFs1oCzAo/Q8Tn3Pz2htI4VN9h3LVsX+JuK3Omf+/vs6I21rIpDE2m/qhO5JH+2gflrsmhHRziHCbokoIr/LYIgkWAzgpiJ4tr2NWc8b32NggepIljfXBMm9TuuorYFNKqG8hpiHAsj5OugBiJUPyuBzPUlvFYdXuT0ireVlNgQcidi873psOWL9QQMrxTZYjd+Ucphk48otp/x7q3LD2luKXkfEsKyMgyVSApSfjdakh2ihJnfvhAfstAN+iuFPu1EYg5+4mUj0Z028TbxSn1hO5ijpgQDh8h guzzijason@macbook" >>/home/demo_user/.ssh/authorized_keys
   [root@ip-172-31-80-91 ~]# chown -R demo_user /home/demo_user/.ssh
   [root@ip-172-31-80-91 ~]# ls -ld $(find /home/demo_user/.ssh)
   drwx------. 2 demo_user root  29 Sep 18 02:25 /home/demo_user/.ssh
   -rw-------. 1 demo_user root 400 Sep 18 02:25 /home/demo_user/.ssh/authorized_keys
   [root@ip-172-31-80-91 ~]#
   

6. Test ssh key login

   [guzzijason@macbook ]$ ssh -i .ssh/demo_user demo_user@54.147.127.91
   Last login: Tue Sep 18 02:28:18 2018 from xxx
   [demo_user@ip-172-31-80-91 ~]$
   

NOTE: a common mistake when setting up ssh keys for a user is not having the correct ownership or permissions on the .ssh directory and authorized_keys file. These are very important! If these permissions are not strictly set, ssh key authentication will fail.

ALSO: PasswordAuthentication yes was set in my sshd_config for all of this.