When I create a new user account I ask users to send me a public key, and want to force users to set the password the first time they log in with keypair authentication. If I create an account with an impossible/disabled and expired password, but put a pubkey in their .ssh/authorized_keys file, the user is required to change his password at first login, but cannot enter his current one!

# adduser --disabled-password foo
# chage -d0 foo

What is a more appropriate way to go about this?

  • 1
    If you pre-install a key for them, what's the point of ever using ChallengeResponseAuthentication? Any subsequent login will prefer the key.
    – bahamat
    Oct 12 '12 at 17:49
  • @bahamat true, but the challenge-response thing was a tangential distraction. I've removed it from the question.
    – kojiro
    Oct 12 '12 at 20:16

You could

  1. Make sure nullok or nullok_secure is not in use in arguments of pam_unix for auth in the pam configuration for any service.
  2. passwd -d foo
  3. chage -d0 foo

That seems to do the trick here (debian wheezy).

  • The two commands must be executed in the reverse order. Otherwise a good answer.
    – Flavius
    Jul 31 '15 at 9:33
  • @Flavius, what system? That order works for me on Debian with version 4.2 of shadow utilities Jul 31 '15 at 11:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.