I am trying to improve the Security of my overall IT Infrastructure, so I started out to use a smart card for login. I have managed to configure a PIV Smart Card with a private key and a x.509 certificate and setup pam_pkcs#11 such that the Smart Card login works. As described in the docs, I have add this:

auth    [success=2 default=ignore]      pam_pkcs11.so

to etc/pam.d/common-auth and since than the smartcard login works. But now, if the reader and the smartcard is removed, the system falls back to a password login (gnome in the case).

So my goal is to completely disable password login, no matter if there is a graphical interface or not. If the reader and the smartcard is not connected, login should not be possible.

Somewhere I have read that passwd -l $(whoami) will set the password for a certain account inactive, but that doesn't feel right to me.

Is it possible to do that with pam, such that password login is disabled for the whole machine?

btw: right now I am using ubuntu 19.10

  • It looks to me that default=ignore tells that it's ok to ignore the module failed (ref: man pam.conf) – A.B Jan 24 at 14:28

It seems that the module pam_unix.so is responsible of standard Unix authentication:

PAM_UNIX(8)                           Linux-PAM Manual                           PAM_UNIX(8)

       pam_unix - Module for traditional password authentication

       pam_unix.so [...]

       This is the standard Unix authentication module. It uses standard calls from the
       system's libraries to retrieve and set account information as well as authentication.
       Usually this is obtained from the /etc/passwd and the /etc/shadow file as well if
       shadow is enabled.

So to totally disable password-based authentication, i suppose that commenting every lines containing pam_unix.so in your /etc/pam.d directory should be enought.

| improve this answer | |
  • this seam to work. I will try this and hope that everything will go on working... thanks. – philipp Jan 24 at 12:32
  • Moreover ... as your ability to log on your systems totally depends on your x509 certificates, i strongly advice you to be very cautious while managing it, especially regarding expiration date ;-) – binarym Jan 24 at 15:07

Some times you require to set passwordless logins to a user for auto logins, shell scripting so that you no need to provide any password. This can be achieved by using passwd command with -d option which deletes already assigned password.


passwd -d USERNAME

Once you are done with this change the password field in /etc/shadow field is changed to empty so that without password you can login from any machine to the local machine. Update: Some users pointed out that this works only for local logins, but for remote logins this will not work.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.