Can a user with no password set login with ssh?

Question

First, I want to be clear, I am not asking about just using public key authentication without a prompt. I have a use case where a user must only be allowed access through SSH public key authentication. Logging in via password on a serial terminal is something I want disabled for this user. I am building my own linux kernel, so the user is created with a home directory that contains an authorized_keys file. In /etc/shadow, the user has an entry with no password: <username>:!:....

My sshd_config contains PasswordAuthentication no, PermitEmptyPasswords yes but even still the user is denied with the correct private key identity file matching that user's ~/.ssh/authorized_keys file. UsePAM no is not supported by this version of the SSH server (at least that is what is reported). All ownership and permissions on the user's files/folder server-side have been validated.

After looking at what I think is the openSSH server (sshd) code, it checks for a locked account in the /etc/shadow password file:

https://github.com/openssh/openssh-portable/blob/V_7_4_P1/auth.c#L141

This leads me to believe that it is folly to try it this way, I should set a password and disable serial logins another way.

This makes intuitive sense but I wanted to get confirmation that the kernel (and openssh) is designed to not allow a user to log in unless as password has been set. Is there any official documentation or word on this? Thanks in advance.

Answer 1

It is possible to configure either behavior.

If the password field in /etc/shadow begins with an exclamation point, then the account is locked. The account cannot be logged into with SSH and generally any attempt to access the account except by root will fail.

If the password contains another invalid password (conventionally, on Linux, a single asterisk), then the account has no password (since the asterisk is not a valid encoding of any crypted password), but can be accessed by SSH public key authentication or other non-password means.

If you use Debian or Ubuntu, you can configure these behaviors with adduser --disabled-login and adduser --disabled-password.

The kernel is not involved in this; the decision is made by PAM and sshd.

Answer 2

Append the client's public key in the $HOME/.ssh/authorized_keys file. This will disable any sort of password prompt. If their private key is protected by a passphrase, have them use an ssh-agent.