Setting up a CentOS 7 cloud server for a client, and have run into an issue with setting it to use a public RSA key instead of a password for one of a handful of SFTP users.

Found an online guide on setting up keys at:


The client supplied a public key file, which I copied to the server using the "ssh-copy-id" command. All good according to the responses I got.

I then locked the account using the "passwd -l" command. Reset the server and checked, and the system confirms that the password is locked:

testuser1 LK 2018-09-17 0 99999 7 -1 (Password locked.)

However, I can still log in using a password using that account on computers that do not have the private key installed.

So, I did more research, and found another tutorial that says you can force the use of RSA keys by setting PasswordAuthentication to no in the etc/ssh/sshd_config file, which raises a concern as other users do not use RSA keys for their login.

Did I do something wrong, or is there something else I can do to disable passwords for this single account? Is there a way to allow some users to use passwords while allowing others to use a RSA key?

  • sudo passwd -l <username> should have worked. Check there are no typos and that sort of thing.
    – mikst
    Commented Sep 17, 2018 at 22:06
  • I agree - a locked password should, in fact, be locked. That's the behavior on my centos nodes. This statement, however, makes me wonder: However, I can still log in using a password using that account on computers that do not have the private key installed. Do you mean that you locked the password on all these other computers, or did you just lock it on one host and expect it to be locked everywhere?
    – guzzijason
    Commented Sep 17, 2018 at 22:12
  • @mikst Thanks for the advice. When I check the user, it shows that the password is locked, so it isn't a case of typos.
    – Charles
    Commented Sep 17, 2018 at 22:24
  • @guzzijason I'll try to clarify. A customer sent me a PUB key that they generated to use instead of a password. I installed the key on a cloud server, and then locked the password for that user account on the server. I then tested using a laptop that doesn't have the private key installed. When I attempt to login to SFTP with that user, I am prompted for a password since I don't have the key, which should not work as it is locked but does. I need to be able to lock password login ability for some users, but not all. Is that possible? If so, what do I need to do to make it work properly?
    – Charles
    Commented Sep 17, 2018 at 22:30
  • 1
    OK, so it prompts you for a password - that's normal, even if the account is locked. You should not be able to authenticate successfully using a password, however - it should always fail.
    – guzzijason
    Commented Sep 17, 2018 at 22:47

1 Answer 1


After spinning up a brand-new CentOS instance in AWS, I went through the process of:

  1. Adding a new user (and setting a password)
  2. Test password login
  3. Lock account
  4. Test password login
  5. Add ssh key to user's account
  6. Test ssh key login

  1. Add new user:

    [centos@ip-172-31-80-91 ~]$ sudo useradd -c "Demo User" -m demo_user
    [centos@ip-172-31-80-91 ~]$ sudo passwd demo_user
    Changing password for user demo_user.
    New password:
    Retype new password:
    passwd: all authentication tokens updated successfully.
  2. Test password login:

    [guzzijason@macbook ]$ ssh [email protected]
    [email protected]'s password:
    [demo_user@ip-172-31-80-91 ~]$
  3. Lock account on server

    [centos@ip-172-31-80-91 ~]$ sudo passwd -l demo_user
    Locking password for user demo_user.
    passwd: Success
  4. Test password login (again; should fail this time)

    [guzzijason@macbook ]$ ssh [email protected]
    [email protected]'s password:
    Permission denied, please try again.
    [email protected]'s password:
    Permission denied, please try again.
    [email protected]'s password:
    [email protected]: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,password).
  5. Add ssh key to user's account on server:

    [centos@ip-172-31-80-91 ~]$ sudo su -
    Last login: Mon Sep 17 22:07:43 UTC 2018 on pts/0
    [root@ip-172-31-80-91 ~]# umask 077
    [root@ip-172-31-80-91 ~]# mkdir /home/demo_user/.ssh
    [root@ip-172-31-80-91 ~]# echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDT+PautYetQxI+J8jshx2bZkMyuxd7dHBlCKjgIr9Y869RP+xzgvFFs1oCzAo/Q8Tn3Pz2htI4VN9h3LVsX+JuK3Omf+/vs6I21rIpDE2m/qhO5JH+2gflrsmhHRziHCbokoIr/LYIgkWAzgpiJ4tr2NWc8b32NggepIljfXBMm9TuuorYFNKqG8hpiHAsj5OugBiJUPyuBzPUlvFYdXuT0ireVlNgQcidi873psOWL9QQMrxTZYjd+Ucphk48otp/x7q3LD2luKXkfEsKyMgyVSApSfjdakh2ihJnfvhAfstAN+iuFPu1EYg5+4mUj0Z028TbxSn1hO5ijpgQDh8h guzzijason@macbook" >>/home/demo_user/.ssh/authorized_keys
    [root@ip-172-31-80-91 ~]# chown -R demo_user /home/demo_user/.ssh
    [root@ip-172-31-80-91 ~]# ls -ld $(find /home/demo_user/.ssh)
    drwx------. 2 demo_user root  29 Sep 18 02:25 /home/demo_user/.ssh
    -rw-------. 1 demo_user root 400 Sep 18 02:25 /home/demo_user/.ssh/authorized_keys
    [root@ip-172-31-80-91 ~]#
  6. Test ssh key login

    [guzzijason@macbook ]$ ssh -i .ssh/demo_user [email protected]
    Last login: Tue Sep 18 02:28:18 2018 from xxx
    [demo_user@ip-172-31-80-91 ~]$

NOTE: a common mistake when setting up ssh keys for a user is not having the correct ownership or permissions on the .ssh directory and authorized_keys file. These are very important! If these permissions are not strictly set, ssh key authentication will fail.

ALSO: PasswordAuthentication yes was set in my sshd_config for all of this.

  • Thanks for the answer. I just read another tutorial on the subject, and it mentions that the tutorial works on CentOs 6, but not on CentOS 7. I'll try again using your suggestions.
    – Charles
    Commented Sep 18, 2018 at 19:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .